SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a core component of a SIEM system?

   • ASignature database for malware definitions
   • BCorrelation engine
   • CVPN concentrator
   • DPacket filtering ruleset
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst notices that a user account has been downloading an unusually large volume of data from a file server every night for the past week. The user's role is in marketing and has never accessed this server before. The UEBA system flags this as anomalous. What is the most appropriate next step for the analyst?

   • AInvestigate the user's recent activity and correlate with other alerts before taking action
   • BIgnore the alert because the user has valid credentials
   • CImmediately disable the user account to prevent further data exfiltration
   • DIncrease the UEBA threshold to reduce false positives
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A multinational company must comply with data residency regulations that require security logs to be stored within the country where the data originates. The company currently uses a single SIEM instance in a central data center. What is the best approach to meet this requirement?

   • AUse a distributed SIEM architecture with regional instances that store and process logs locally
   • BEncrypt all logs before sending them to the central SIEM
   • CDeploy SIEM collectors in each country that forward logs to the central SIEM
   • DStore logs only in the central SIEM and rely on legal agreements
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A UEBA system is deployed in an organization where employees work in shifts and some users legitimately access systems at odd hours. The security team is concerned about false positives. What is the best way to configure the UEBA to reduce false positives while still detecting genuine anomalies?

   • ASet a global threshold for all users based on the average employee
   • BUse only rule-based alerts for known attack patterns
   • CDisable alerts for off-hours access because it is common in the organization
   • DAllow the UEBA to learn each user's normal behavior over time, including shift patterns, before alerting
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security analyst needs to investigate a suspicious PowerShell command that executed on a laptop two days ago. The analyst wants to see the full command line, the parent process, and any files created by that process. Which endpoint security capability should the analyst use?

   • AApplication control allowlist reports
   • BDevice control audit logs
   • CAntivirus scan logs
   • DEndpoint Detection and Response (EDR) telemetry
   Reveal Solution Discussion Select an answer first