SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A user's account was compromised. The UEBA system alerted because the user logged in from a new geolocation, accessed a large volume of data, and created email forwarding rules — all within 30 minutes. Which UEBA capability primarily enabled this detection?

   • AFirewall rule review
   • BVulnerability scanning of user devices
   • CBehavioral baseline deviation analysis
   • DSignature-based malware detection
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An organization is considering deploying EDR across its endpoints, but the security team is concerned about the operational overhead of managing alerts and the potential for alert fatigue. They want to ensure that the EDR is effective without overwhelming the small security team. Which approach best addresses this concern?

   • AIncrease the alert threshold to only show critical alerts
   • BConfigure EDR to automatically respond to high-confidence threats and only alert on lower-confidence events for manual review
   • CDisable all alerts and rely solely on automated response
   • DAssign one analyst to monitor all EDR alerts
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A UEBA platform generates an alert for a user who is downloading an unusually large amount of data from a file share. The security team wants to confirm whether this is a true positive before responding. What should the team do first?

   • AImmediately block the user's account
   • BDisable the UEBA alert rule to prevent further alerts
   • CCorrelate the alert with the user's recent activity and the file share access logs in the SIEM
   • DIncrease the user's data download quota in the file server
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization has a SIEM and a UEBA platform that are not integrated. The security team is missing alerts that require combining behavioral anomalies with network event data. What is the primary benefit of integrating UEBA with the SIEM?

   • AReplacing the SIEM's correlation engine with UEBA's machine learning
   • BEnriching SIEM alerts with behavioral context and enabling correlation across both data sets
   • CAutomatically blocking all anomalous user sessions
   • DEliminating the need for log collection from endpoints
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A UEBA system is deployed in an organization with a high rate of employee turnover. New employees often perform tasks that differ from their job descriptions, and the UEBA is generating false positives for these employees. The security team wants to reduce false positives while still detecting genuine insider threats. What is the best approach?

   • AUse a shorter learning period for new employees and update baselines more frequently
   • BIncrease the anomaly threshold for all users
   • CDisable UEBA alerts for all new employees for the first six months
   • DSet a global baseline based on the average employee behavior
   Reveal Solution Discussion Select an answer first