SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 12)

Questions 56–59

1. 56application · medium

   A security manager is evaluating SIEM solutions and wants to ensure the chosen product can collect logs from cloud services, on-premises servers, and network devices. Which SIEM component is most critical for this requirement?

   • ACorrelation engine that applies rules to events
   • BIncident response workflow module
   • CLog collectors or agents that support multiple data sources and formats
   • DAlert dashboard for visualizing incidents
   Reveal Solution Discussion Select an answer first
2. 57application · medium

   A company's SIEM receives logs from firewalls, Windows event logs, and Linux syslog in different formats. The security team wants to detect a multi-stage attack where an attacker first performs a port scan, then exploits a web vulnerability, and later uses the same source IP to attempt lateral movement. Which SIEM capability is most directly required to make these events meaningful for detection?

   • AIntegration with a ticketing system for incident response workflow
   • BNormalization and correlation of events from multiple sources into a common schema
   • CLong-term storage of raw logs for compliance retention
   • DReal-time alerting configured for each individual log source
   Reveal Solution Discussion Select an answer first
4. 58foundation · easy

   What capability distinguishes EDR from traditional antivirus?

   • AFirewall rule management
   • BNetwork traffic encryption
   • CThreat hunting and forensic investigation capabilities
   • DSignature-based malware detection only
   Reveal Solution Discussion Select an answer first
5. 59expert · hard

   A UEBA system flags a service account that authenticates from a new IP address and accesses a database it has never accessed before. The security team is unsure whether this is a true positive because the account is used by an application that was recently updated. What should the team do?

   • ATreat the alert as a true positive and immediately rotate the service account credentials
   • BDisable the service account until the investigation is complete
   • CCheck the application change logs and correlate with the UEBA alert to determine if the behavior is expected
   • DAdd the service account to a permanent allowlist in the UEBA system
   Reveal Solution Discussion Select an answer first