SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A SIEM is receiving logs from multiple sources, but the security team is overwhelmed by false positives. They suspect that the correlation rules are too broad. The team wants to reduce false positives without missing real attacks. What is the most effective approach?

   • AReduce the number of log sources feeding the SIEM
   • BIncrease the alert threshold for all rules to reduce volume
   • CRefine correlation rules to require multiple conditions and use context from multiple log sources
   • DDisable the rules that generate the most alerts
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An organization wants to ensure that only approved software can run on its point-of-sale terminals to prevent unauthorized applications. Which endpoint security technology is designed for this purpose?

   • AEDR that monitors for suspicious behavior
   • BDevice control that restricts USB devices
   • CApplication control that maintains a whitelist of approved executables
   • DAntivirus that scans for known malware
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   How can EDR provide automated response to a detected threat on an endpoint?

   • ABy isolating the endpoint from the network or terminating malicious processes
   • BBy encrypting the entire hard drive
   • CBy changing the user's password
   • DBy physically disconnecting the power cable
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What does 'normalization' mean in the context of SIEM data processing?

   • ADeleting duplicate log entries to reduce storage
   • BConverting logs from different formats into a common, consistent structure
   • CEncrypting log data to protect it during transmission
   • DPrioritizing logs based on the severity of the source system
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   An organization wants to prevent employees from running unauthorized software on their workstations while also allowing IT-approved tools. They are considering application control. What is the most important factor for a successful implementation?

   • AUsing a blocklist of known malicious applications
   • BImplementing an allowlist that includes all approved applications and updating it as new tools are approved
   • CRelying on users to request exceptions when they need new software
   • DDeploying the control in enforcement mode immediately
   Reveal Solution Discussion Select an answer first