A company has deployed a User and Entity Behavior Analytics (UEBA) system to detect insider threats. The UEBA has established a baseline for each user's normal behavior, including login times, data access patterns, and file transfer volumes. Which of the following user activities would the UEBA most likely flag as anomalous?

A user who normally works from 9 AM to 5 PM logs in at 3 AM and downloads a large volume of data from a file share they rarely access.

A user accesses a file share that is part of their normal job responsibilities during business hours.

A user sends an email to a colleague that contains a document they have worked on before.

A user logs in at their usual time and accesses the same files they access every day.

Which of the following is a typical use case for a SIEM?

Automatically patching vulnerable systems

Replacing the need for a firewall

Supporting compliance reporting by providing audit trails

Providing real-time antivirus protection

What is a best practice for tuning a SIEM to reduce false positives?

Adjust correlation rules based on observed false positives

Only collect logs from critical servers

Increase the log retention period

Certified Information Systems Security Professional

Domain 7Objective 2

7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 3)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

12concepts

13%of the exam

Questions 11–15

11application · medium
A company has deployed a User and Entity Behavior Analytics (UEBA) system to detect insider threats. The UEBA has established a baseline for each user's normal behavior, including login times, data access patterns, and file transfer volumes. Which of the following user activities would the UEBA most likely flag as anomalous?
Select an answer first
12foundation · easy
Which log analysis technique is used to identify deviations from a known baseline of normal activity?
Select an answer first
13foundation · easy
Which of the following is a typical use case for a SIEM?
Select an answer first
14foundation · easy
What is a best practice for tuning a SIEM to reduce false positives?
Select an answer first
15foundation · easy
Which egress monitoring technique provides information about the volume and flow of network traffic but does not inspect the content of the traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

7.2 - Conduct Logging and Monitoring Activities CISSP Practice Questions (Page 3)

Questions 11–15

Which log analysis technique is used to identify deviations from a known baseline of normal activity?

Which of the following is a typical use case for a SIEM?

What is a best practice for tuning a SIEM to reduce false positives?

Which egress monitoring technique provides information about the volume and flow of network traffic but does not inspect the content of the traffic?

Keep studying — Security Operations