A financial firm wants to prevent employees from copying sensitive client data to USB drives while still allowing them to use USB keyboards and mice. Which endpoint security control should be configured?

EDR that alerts on file copy operations

Antivirus that scans USB drives on insertion

Application control that prevents file explorer from running

Device control that blocks storage devices but allows HID devices

A security analyst wants to detect a multi-stage attack where an attacker first scans the network, then exploits a vulnerability, and later exfiltrates data. The individual events are logged in different sources. What SIEM capability is essential for this detection?

Correlation and event sequencing

A company allows employees to use personal laptops for remote work. The security team needs to ensure these devices meet a minimum security baseline before they can access corporate email. What should the team implement?

Endpoint compliance checking that verifies antivirus, patch level, and disk encryption before access

A network firewall to filter traffic from personal laptops

A UEBA baseline for each personal laptop

A SIEM rule that alerts when personal laptops connect

Which type of threat is UEBA specifically designed to help detect?

SQL injection attacks on web applications

Malware infections detected by signature matching

Insider threats and compromised accounts

What makes a UEBA alert 'actionable' for a security team?

It automatically resets the user's password

It is sent only to the end user who triggered it

It contains the raw logs from all systems without any analysis

It includes context such as the affected user, entity, and the specific anomalous behavior

EC-CouncilNetwork Defense Essentials

Domain 3Objective 5

SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 6)

Part of the Technical Security Controls domain, which makes up ~16% of our current practice bank.

59questions here

12free pages

10concepts

10 Concepts in This Objective

SIEM Fundamentals
SIEM Data Collection and Analysis
SIEM Deployment and Use Cases
UBA/UEBA Fundamentals
Baseline and Anomaly Detection
UBA/UEBA Integration and Alerts
Endpoint Security Fundamentals
Endpoint Protection Technologies
Endpoint Detection and Response (EDR)
Endpoint Security Management and Best Practices

Questions 26–30

26application · medium
A financial firm wants to prevent employees from copying sensitive client data to USB drives while still allowing them to use USB keyboards and mice. Which endpoint security control should be configured?
Select an answer first
27application · medium
A security analyst wants to detect a multi-stage attack where an attacker first scans the network, then exploits a vulnerability, and later exfiltrates data. The individual events are logged in different sources. What SIEM capability is essential for this detection?
Select an answer first
28application · medium
A company allows employees to use personal laptops for remote work. The security team needs to ensure these devices meet a minimum security baseline before they can access corporate email. What should the team implement?
Select an answer first
29foundation · easy
Which type of threat is UEBA specifically designed to help detect?
Select an answer first
30foundation · easy
What makes a UEBA alert 'actionable' for a security team?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.