SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is deploying EDR agents to 5,000 endpoints. The security team wants to ensure that the rollout does not disrupt business operations and that the agents are properly configured. What is the best practice for this deployment?

   • APilot the deployment on a small group, test compatibility, then roll out in phases
   • BConfigure agents with maximum blocking settings from the start
   • CDeploy to all endpoints at once using a forced installation
   • DInstall agents only on servers and skip workstations
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a typical use case for a SIEM system?

   • AProviding a backup and recovery solution for critical servers
   • BReplacing the need for endpoint antivirus software
   • CSupporting incident response by providing centralized log analysis
   • DManaging user access permissions in Active Directory
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a best practice for managing endpoint security in an enterprise?

   • ADisabling security software to improve system performance
   • BInstalling security updates only when a problem occurs
   • CCentralized management and regular updates of endpoint protection software
   • DUsing different security policies for every individual endpoint
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization needs to demonstrate to an auditor that all authentication failures across servers and network devices are being reviewed. The security team currently collects logs in a SIEM. What should the team configure to satisfy this requirement?

   • AA scheduled report of authentication failures with a documented review process
   • BA dashboard showing real-time authentication failure counts
   • CA raw log export stored in a shared folder
   • DAn alert that fires once when the first authentication failure is seen
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A UEBA system is generating too many alerts for a group of users who frequently travel and access the network from different countries. The security team wants to reduce noise without missing real threats. What is the best approach?

   • ACreate a peer group of frequent travelers and adjust the anomaly threshold for that group
   • BIgnore alerts from frequent travelers
   • CIncrease the global anomaly threshold for all users
   • DDisable location-based anomaly detection for all users
   Reveal Solution Discussion Select an answer first