SIEM, UBA/UEBA, and Endpoint Security Solutions NDE Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A UEBA system has been in production for two weeks. It is generating a high volume of alerts for a group of users who recently changed their work patterns due to a new project. The security team is overwhelmed and considering tuning the system. What is the most appropriate action?

   • AImmediately raise the anomaly threshold to reduce alert volume
   • BManually create rules to whitelist all activities from the new project
   • CDisable alerts for the affected user group
   • DWait for the baseline to mature and then review alert patterns before tuning
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A company is deploying a new endpoint security solution across 5,000 workstations. The security team wants to ensure consistent configuration and rapid deployment without disrupting users. Which best practice should be followed?

   • ADeploy only to high-risk endpoints and skip the rest
   • BUse a phased rollout with centralized management and automated policy deployment
   • CLet each department configure the solution independently
   • DInstall the solution on all endpoints simultaneously with default settings
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A small company with a limited security budget wants to deploy a SIEM to meet regulatory logging requirements and detect known attack patterns. They have no dedicated security operations staff and want to minimize infrastructure maintenance. Which deployment model best fits these constraints?

   • AOn-premises SIEM appliance managed by the existing IT team
   • BOpen-source SIEM installed on a single server with custom rules
   • CCloud-based SIEM service with pre-built compliance and correlation content
   • DHybrid SIEM with on-premises collection and cloud analytics
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which endpoint security technology controls which applications are allowed to run on a system?

   • ADevice control
   • BApplication control
   • CAntivirus
   • DEDR
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company's UEBA solution has been monitoring user activity for three months. The security team wants to reduce false positives from alerts triggered by legitimate after-hours work by system administrators. What is the most effective way to address this?

   • AAdd the system administrators to a watchlist for manual review every morning
   • BIncrease the anomaly threshold globally so fewer events trigger alerts
   • CCreate a separate baseline for system administrators that includes their typical after-hours activity
   • DDisable after-hours alerts for all administrative accounts
   Reveal Solution Discussion Select an answer first