SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is experiencing frequent ransomware infections on employee laptops despite having traditional antivirus installed. The infections often start with a user opening a malicious email attachment. Which endpoint security solution would be most effective at preventing and detecting this type of threat?

   • AEndpoint Detection and Response (EDR) with behavioral analysis and automated response
   • BUpdating the traditional antivirus signatures more frequently
   • CApplication control that only allows approved software to run
   • DDevice control that restricts USB device usage
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company's endpoints are being infected with malware that encrypts files and demands ransom. Traditional antivirus is not detecting the malware because it is polymorphic. Which additional endpoint security layer would be most effective at detecting this behavior?

   • AMore frequent signature updates
   • BBehavioral monitoring that detects mass file encryption and alerts on suspicious processes
   • CApplication control that blocks all executables
   • DDevice control that blocks USB drives
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A small company with no dedicated security team wants to meet PCI DSS log review requirements without deploying and maintaining its own SIEM infrastructure. Which SIEM deployment model best fits this constraint?

   • AOn-premises SIEM appliance
   • BSelf-managed open-source SIEM on a cloud VM
   • CHybrid SIEM with on-premises collectors only
   • DCloud-based SIEM as a managed service
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst notices that the SIEM receives raw logs from firewalls, Windows Event Logs, and Linux syslog in different formats. The analyst wants to search for all failed login attempts across these sources using a single query. What should the analyst configure in the SIEM to achieve this?

   • ACreate a correlation rule that triggers on any log containing 'failed login'
   • BSet up a data forwarder on each source to convert logs to JSON before sending them to the SIEM
   • CConfigure parsing and normalization to map source-specific fields to a common event schema
   • DEnable log source grouping so all sources appear under one folder in the search interface
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How does a SIEM detect a security incident that individual log sources would not reveal?

   • ABy scanning files for malware signatures on each endpoint
   • BBy resetting user passwords after failed login attempts
   • CBy blocking suspicious IP addresses at the firewall
   • DBy correlating events from multiple sources to identify a pattern of attack
   Reveal Solution Discussion Select an answer first