2.2 Identifying a Baseline of User, Asset, and Entity Context PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is correlating data from multiple sources to identify a user's activities across different systems. The user's username is 'asmith', email is 'alice.smith@example.com', and employee ID is 'A1234'. The team wants to enrich a cloud access security broker (CASB) log that contains the email address with the user's department from the HR system. Which approach is most reliable?

   • AUse the email address in the CASB log to directly join with the HR system's employee ID field.
   • BUse the username 'asmith' to join with the HR system's email field.
   • CUse the employee ID to join with the CASB log's email field.
   • DUse a canonical user ID that maps email, username, and employee ID, then join with the HR system.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A threat intelligence feed contains indicators that are over six months old. According to best practices for relevance assessment, what should the analyst do with this outdated intelligence?

   • AOnly use it if it is from a vendor report
   • BConvert it to a different format to make it useful
   • CDiscard or deprioritize it because it may no longer be accurate
   • DUse it as-is because all intelligence is valuable
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team wants to enrich endpoint detection and response (EDR) alerts with the asset's owner and location from the asset management system. The EDR alerts contain the hostname, while the asset management system uses the asset's serial number. Which aliasing field should be used to join these datasets?

   • ASerial number to location
   • BHostname to owner
   • CEDR alert timestamp to asset management system's last update time
   • DHostname to serial number
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security analyst wants to correlate a login event with the user's department information stored in an identity provider. Which aliasing field would be used to join these two data sets?

   • ATimestamp
   • BIP address
   • CHostname
   • DUser ID
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of entity data, as opposed to event data, in a security analytics context?

   • AAsset inventory listing all company laptops and their owners
   • BEndpoint log of a process execution
   • CFirewall log showing a blocked connection attempt
   • DCloud Audit Log entry for a VM creation
   Reveal Solution Discussion Select an answer first