Adaptive Threat Profiling JN0-336 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company is considering whether to use adaptive threat profiling to detect zero-day attacks. They already have a sandboxing solution. The security team wants to know if profiling adds value. What is the best justification for implementing profiling?

   • AProfiling can detect anomalies that indicate a zero-day attack even when no signature exists.
   • BProfiling is only useful for known malware.
   • CProfiling replaces the need for sandboxing entirely.
   • DProfiling can block all zero-day attacks automatically.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the context of Juniper ATP Cloud, how does adaptive threat profiling differ from traditional signature-based detection?

   • AIt uses behavioral analysis to detect anomalies without relying solely on known signatures
   • BIt relies on a database of known malware signatures to match against network traffic
   • CIt only detects threats that have been previously identified and cataloged
   • DIt requires manual updates to the signature database to remain effective
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital network uses ATP Cloud and wants to ensure that adaptive threat profiling does not generate alerts for legitimate after-hours access by on-call radiologists. What is the best way to configure the profiling policy?

   • ABlock all off-hours access to the radiology systems.
   • BCreate a policy exception for the radiologist group's known off-hours access patterns.
   • CDisable profiling for all users to avoid false positives.
   • DSet the profiling threshold to the highest sensitivity to catch all anomalies.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard · select all that apply

   A security team is evaluating the effectiveness of adaptive threat profiling in their environment. They want to ensure that the profiling data is accurate and actionable. Which of the following actions should they take? (Select all that apply.)

   • AEnsure that profiling is integrated with ATP Cloud's other detection features.
   • BMonitor profiling reports for trends and adjust policies accordingly.
   • CRely solely on profiling alerts without correlating with other security data.
   • DRegularly review and update the baseline to reflect changes in user behavior.
   • EDisable profiling during peak business hours to reduce false positives.
   Check answers Discussion Select an answer first
6. 10expert · hard

   A security analyst sees an alert that a user's account has been making large data transfers to an external cloud storage service. The user is a developer who frequently uses cloud storage for legitimate work. The analyst must decide whether to escalate. What is the most important information to review?

   • AThe user's historical data transfer patterns and the destination's reputation.
   • BThe total number of alerts generated in the last hour.
   • CThe user's job title and department.
   • DThe user's password change history.
   Reveal Solution Discussion Select an answer first