What is the primary purpose of User and Entity Behavior Analytics (UEBA)?

To block all network traffic from unknown IP addresses

To encrypt data stored on endpoints

To replace antivirus software on user workstations

To detect anomalies in the behavior of users and devices that may indicate security threats

What role does machine learning play in UEBA anomaly detection?

It encrypts user communications to prevent eavesdropping

It identifies deviations from learned behavioral baselines

It replaces the need for any log collection

It automatically blocks all suspicious activities

Which of the following is a common SIEM deployment model?

Distributed only, because centralized SIEM is obsolete

Agentless only, because agents are deprecated

Open-source only, because commercial SIEM is no longer available

On-premises, cloud-based, or hybrid

How does UEBA establish a baseline of normal behavior?

By observing and learning from historical activity patterns over time

By applying a fixed set of rules defined by the vendor

By using only the most recent 24 hours of data

By comparing all users to a single industry-standard profile

An organization is evaluating whether to replace its traditional antivirus with an EDR solution. The security team is concerned about the operational impact of EDR's continuous monitoring and automated response. What is the most important consideration when making this decision?

EDR requires more storage and processing resources on endpoints

EDR provides deeper visibility and response capabilities but requires skilled analysts to manage alerts

EDR can replace antivirus entirely without any additional configuration

EDR only works on Windows endpoints

EC-CouncilNetwork Defense Essentials

Domain 3Objective 5

SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 3)

Part of the Technical Security Controls domain, which makes up ~16% of our current practice bank.

59questions here

12free pages

10concepts

10 Concepts in This Objective

SIEM Fundamentals
SIEM Data Collection and Analysis
SIEM Deployment and Use Cases
UBA/UEBA Fundamentals
Baseline and Anomaly Detection
UBA/UEBA Integration and Alerts
Endpoint Security Fundamentals
Endpoint Protection Technologies
Endpoint Detection and Response (EDR)
Endpoint Security Management and Best Practices

Questions 11–15

11foundation · easy
What is the primary purpose of User and Entity Behavior Analytics (UEBA)?
Select an answer first
12foundation · easy
What role does machine learning play in UEBA anomaly detection?
Select an answer first
13foundation · easy
Which of the following is a common SIEM deployment model?
Select an answer first
14foundation · easy
How does UEBA establish a baseline of normal behavior?
Select an answer first
15expert · hard
An organization is evaluating whether to replace its traditional antivirus with an EDR solution. The security team is concerned about the operational impact of EDR's continuous monitoring and automated response. What is the most important consideration when making this decision?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.