2.2 Identifying a Baseline of User, Asset, and Entity Context PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team is designing a data pipeline to support user and entity behavior analytics (UEBA). They need to distinguish between event data and entity data to properly store and process them. Which statement correctly differentiates event data from entity data?

   • AEvent data includes asset inventory, while entity data includes network logs.
   • BEvent data is used for enrichment, while entity data is used for detection rules.
   • CEvent data includes Cloud Audit Logs and firewall logs, while entity data includes Active Directory attributes and asset inventory.
   • DEvent data is static and rarely changes, while entity data is dynamic and changes frequently.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst needs to investigate a potential data exfiltration incident. Which combination of event data sources would provide the most relevant information about network traffic and user actions?

   • AActive Directory and identity provider logs
   • BAsset management system and configuration management database (CMDB)
   • CFirewall logs and endpoint logs
   • DCloud Audit Logs and asset inventory
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team is correlating VPN login events with employee records from the HR system. The VPN logs contain the employee's corporate email, while the HR system uses a unique employee ID. To enrich VPN events with the employee's job role, which aliasing field should be used to join the two datasets?

   • AVPN log timestamp to HR record timestamp
   • BEmployee ID to job role
   • CCorporate email to employee ID
   • DCorporate email to job role
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A security operations team wants to incorporate external threat intelligence into their SIEM. Which of the following is a common source of threat intelligence that provides indicators of compromise (IOCs) such as malicious IP addresses and domains?

   • AActive Directory
   • BAsset inventory
   • CThreat feeds
   • DCloud Audit Logs
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of an aliasing field that could be used to enrich a network connection event with asset information from an asset inventory?

   • ASeverity level
   • BLog source name
   • CSource IP address
   • DEvent timestamp
   Reveal Solution Discussion Select an answer first