SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of a Security Information and Event Management (SIEM) system?

   • ATo automatically patch vulnerabilities on servers and workstations
   • BTo encrypt all network traffic between endpoints and the corporate data center
   • CTo replace firewalls and intrusion prevention systems as the primary network defense layer
   • DTo provide centralized collection, correlation, and analysis of security log data from multiple sources
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A system administrator notices that a service account is logging in from a new location and at unusual times, but the account has a history of being used by automated scripts. The UEBA system has not raised an alert. What is the most likely reason for the lack of alert?

   • AThe UEBA is not configured to monitor service accounts
   • BThe UEBA only alerts on user accounts, not service accounts
   • CThe UEBA baseline includes the new location and times because the account's behavior is already considered normal
   • DThe new location is within the same country as the server
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a mix of Windows and Linux endpoints. The security team wants to deploy an EDR solution that provides centralized management, automated response, and supports both operating systems. They also want to minimize the number of vendors. What should they consider?

   • ADeploy EDR only on servers and use traditional antivirus on workstations
   • BChoose a single EDR platform that supports both Windows and Linux with centralized management
   • CDeploy a separate EDR product for Windows and another for Linux
   • DUse antivirus for Windows and EDR only for Linux
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is investigating a suspicious process on an endpoint. The EDR console shows the process has been making outbound network connections and modifying registry keys. The analyst wants to understand the full scope of the attack. Which EDR feature is most useful for this investigation?

   • ADevice control policy that blocks USB devices
   • BAntivirus definition update
   • CProcess tree and timeline visualization of related events
   • DSignature-based malware scan of the endpoint
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a ransomware outbreak, an EDR solution detects the encryption process on a workstation and automatically isolates the endpoint from the network. What is the primary benefit of this automated response?

   • AIt prevents the ransomware from spreading to other systems
   • BIt notifies the user to reboot the system
   • CIt recovers encrypted files automatically
   • DIt deletes the ransomware from the endpoint
   Reveal Solution Discussion Select an answer first