A hospital wants to prevent staff from copying patient data to USB drives while still allowing them to use USB keyboards and mice. Which endpoint security control should be configured?

Device control to block USB mass storage but allow HID devices

EDR to quarantine any file that is copied to a USB drive

Application control to block all executables from USB drives

Antivirus to scan USB drives on insertion

How does UEBA typically integrate with a SIEM system?

UEBA blocks traffic directly on the firewall

UEBA requires the SIEM to be decommissioned

UEBA replaces the SIEM's log storage entirely

UEBA sends alerts and risk scores to the SIEM for centralized analysis

A large enterprise is rolling out EDR to 10,000 endpoints. The security team wants to minimize user disruption while ensuring that critical business applications are not blocked. They also need to maintain visibility across all endpoints. Which deployment strategy best balances these concerns?

Phased deployment with a pilot group, using monitoring mode first and then enforcing policies

Immediate full deployment with enforcement mode enabled

Deploy only to endpoints that have experienced incidents in the past

Deploy to all endpoints but disable all blocking features

A healthcare organization must retain access logs for six years to comply with regulations. They also need to detect unauthorized access to patient records in real time. Which SIEM use case is best addressed by configuring log retention policies?

Compliance reporting and forensic investigation

A security team wants to proactively search for indicators of compromise on endpoints that may have been missed by automated detection. Which EDR capability enables this activity?

Threat hunting using live query and historical data collection

EC-CouncilNetwork Defense Essentials

Domain 3Objective 5

SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 7)

Part of the Technical Security Controls domain, which makes up ~16% of our current practice bank.

59questions here

12free pages

10concepts

10 Concepts in This Objective

SIEM Fundamentals
SIEM Data Collection and Analysis
SIEM Deployment and Use Cases
UBA/UEBA Fundamentals
Baseline and Anomaly Detection
UBA/UEBA Integration and Alerts
Endpoint Security Fundamentals
Endpoint Protection Technologies
Endpoint Detection and Response (EDR)
Endpoint Security Management and Best Practices

Questions 31–35

31application · medium
A hospital wants to prevent staff from copying patient data to USB drives while still allowing them to use USB keyboards and mice. Which endpoint security control should be configured?
Select an answer first
32foundation · easy
How does UEBA typically integrate with a SIEM system?
Select an answer first
33expert · hard
A large enterprise is rolling out EDR to 10,000 endpoints. The security team wants to minimize user disruption while ensuring that critical business applications are not blocked. They also need to maintain visibility across all endpoints. Which deployment strategy best balances these concerns?
Select an answer first
34application · medium
A healthcare organization must retain access logs for six years to comply with regulations. They also need to detect unauthorized access to patient records in real time. Which SIEM use case is best addressed by configuring log retention policies?
Select an answer first
35application · medium
A security team wants to proactively search for indicators of compromise on endpoints that may have been missed by automated detection. Which EDR capability enables this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “NDE” is a trademark of its owner, used for identification only.