2.2 Identifying a Baseline of User, Asset, and Entity Context PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In security analytics, which of the following best describes the role of event data?

   • AIt provides a record of activities and occurrences that can be analyzed for suspicious patterns
   • BIt is the same as entity data
   • CIt provides static information about users and assets
   • DIt is used only for compliance reporting
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of enriching event data with entity context?

   • ATo improve detection and investigation by providing additional context
   • BTo make event data compliant with regulations
   • CTo reduce the volume of event data
   • DTo replace event data with entity data
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is investigating a suspicious login event from an IP address. The event log contains the user's email address, but the identity provider (IdP) logs use a numeric user ID. The asset inventory uses hostnames, while the endpoint logs use IP addresses. To enrich the login event with the user's department and asset owner, which aliasing fields should the analyst use to correlate the data?

   • AEmail address to hostname, and IP address to numeric user ID
   • BEmail address to numeric user ID, and IP address to hostname
   • CNumeric user ID to hostname, and email address to IP address
   • DHostname to email address, and numeric user ID to IP address
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst is setting up a threat intelligence ingestion pipeline. Which of the following is a standardized protocol for exchanging cyber threat intelligence in a machine-readable format?

   • ACSV
   • BSyslog
   • CREST API
   • DSTIX/TAXII
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is creating a dashboard to show the number of failed login attempts per user. Which data source should be used for this metric?

   • AActive Directory attributes
   • BAuthentication logs
   • CConfiguration management database (CMDB)
   • DAsset inventory
   Reveal Solution Discussion Select an answer first