How are user behavior baselines used in security monitoring?

To identify deviations from normal user activity

A university's network team wants to detect a potential data exfiltration via DNS tunneling. They have captured NetFlow data for the past six months. What is the most appropriate baseline to establish for this detection?

Standard web browsing traffic volume to external sites

Typical volume and size of DNS queries per internal host during business hours

Average number of failed login attempts per user per day

List of all approved software versions installed on endpoints

A regional bank's security team is building a threat intelligence program. They need to understand targeted phishing campaigns against financial institutions in their specific geographic region, but they have a limited budget and cannot afford commercial threat feeds. Which approach best meets their requirement?

Rely solely on internal security logs and past incident data to identify future phishing patterns

Establish a formal information-sharing partnership with peer financial institutions and regional ISACs

Subscribe to a commercial threat intelligence platform that aggregates global feeds

Deploy a honeypot network to attract and analyze phishing attempts against the bank

Which of the following is an example of a user behavior baseline characteristic?

Typical login times and resource usage

Information Systems Security Management Professional

Domain 4Objective 2

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 9)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

18%of the exam

15 Concepts in This Objective

Threat intelligence sources
Threat data aggregation
Baseline analysis of network traffic
Baseline analysis of data
Baseline analysis of user behavior
Anomaly detection techniques
Anomaly analysis and investigation
Threat modeling methodologies
Threat modeling process
Attack classification
Attack categorization frameworks
Security event correlation
Correlation rules and tools
Actionable alert definition
Alert tuning and prioritization

Questions 41–45

41foundation · easy
How are user behavior baselines used in security monitoring?
Select an answer first
42application · medium
A university's network team wants to detect a potential data exfiltration via DNS tunneling. They have captured NetFlow data for the past six months. What is the most appropriate baseline to establish for this detection?
Select an answer first
43application · medium
A regional bank's security team is building a threat intelligence program. They need to understand targeted phishing campaigns against financial institutions in their specific geographic region, but they have a limited budget and cannot afford commercial threat feeds. Which approach best meets their requirement?
Select an answer first
44foundation · easy
Which of the following is an example of a user behavior baseline characteristic?
Select an answer first
45foundation · easy
Which model describes the stages of a cyberattack from reconnaissance to actions on objectives?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

4.2 Establish and Maintain Threat Intelligence Program ISSMP Practice Questions (Page 9)

Questions 41–45

How are user behavior baselines used in security monitoring?

A university's network team wants to detect a potential data exfiltration via DNS tunneling. They have captured NetFlow data for the past six months. What is the most appropriate baseline to establish for this detection?

Which of the following is an example of a user behavior baseline characteristic?

Which model describes the stages of a cyberattack from reconnaissance to actions on objectives?

Keep studying — Security Operations