2.2 Identifying a Baseline of User, Asset, and Entity Context PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations team is building a UEBA solution and needs to import user context such as job title, department, and manager. Which entity data source should they use?

   • ANetwork flow logs
   • BEndpoint detection and response (EDR) alerts
   • CIdentity provider (IdP) directory
   • DCloud Audit Logs
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is evaluating threat intelligence sources to improve detection of phishing campaigns targeting their employees. Which source would be most directly applicable to this goal?

   • AA feed of malware hashes from a general-purpose malware repository
   • BA STIX/TAXII feed of vulnerabilities from a national vulnerability database
   • CA list of known malicious IP addresses from a public blocklist
   • DA vendor report on recent phishing tactics, techniques, and procedures (TTPs) and associated indicators
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following event data sources is most likely to provide information about network connections and traffic patterns?

   • ANetwork logs (e.g., firewall logs, flow logs)
   • BActive Directory
   • CIdentity provider
   • DAsset management system
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An analyst enriches a firewall log entry with the asset owner's name from an asset management system. What is this process called?

   • AData aggregation
   • BData deduplication
   • CData normalization
   • DData enrichment
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security analyst is correlating authentication events from multiple sources. The VPN logs use the username 'jdoe', the cloud identity provider uses the email 'john.doe@example.com', and the HR system uses employee ID 'E12345'. The analyst needs to enrich authentication events with the user's job role. Which approach is most effective for establishing a reliable correlation?

   • AUse the username 'jdoe' to directly join with the HR system's employee ID field.
   • BUse the employee ID to join with the cloud identity provider's email field.
   • CCreate a lookup table that maps username, email, and employee ID to a canonical user ID, then use that ID for enrichment.
   • DUse the email address to join with the VPN logs' username field.
   Reveal Solution Discussion Select an answer first