Adaptive Threat Profiling JN0-336 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A multinational company has offices in different time zones. They use ATP Cloud and want to profile user behavior to detect anomalies. The security team is concerned that legitimate cross-time-zone access will trigger false positives. What is the most effective way to configure profiling?

   • AUse a single global policy with a high anomaly threshold.
   • BSet the profiling to learn from the most active office only.
   • CDisable profiling for all users in non-headquarters offices.
   • DCreate separate profiling policies for each time zone or office location.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization wants to use adaptive threat profiling to enhance its existing ATP Cloud malware detection. The security team wants alerts from profiling to be correlated with other ATP Cloud features. What should they configure?

   • AUse only the profiling reports and ignore other ATP Cloud alerts.
   • BEnable integration between adaptive threat profiling and ATP Cloud's other detection engines so alerts are correlated in a single incident view.
   • CConfigure the firewall to block all traffic from profiled users.
   • DDisable all other ATP Cloud features to avoid alert fatigue.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security architect wants to ensure that adaptive threat profiling alerts are automatically enriched with threat intelligence from ATP Cloud's other services. What is the correct way to achieve this?

   • AExport profiling logs to a third-party SIEM for manual enrichment.
   • BEnable the integration between adaptive threat profiling and ATP Cloud's threat intelligence feeds.
   • CUse only the profiling reports and ignore other ATP Cloud features.
   • DConfigure the firewall to tag all profiled traffic.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security architect is designing a defense-in-depth strategy and wants to use ATP Cloud's adaptive threat profiling alongside other security controls. The architect wants to ensure that profiling alerts trigger automated responses in the firewall. What is the correct way to achieve this?

   • AConfigure the firewall to block all traffic from profiled users.
   • BUse ATP Cloud's integration with the firewall to automatically block traffic based on profiling alerts.
   • CUse a third-party SIEM to manually create firewall rules.
   • DManually block IP addresses based on profiling reports.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard · select all that apply

   A company wants to implement adaptive threat profiling to detect both external attacks and insider threats. The security team is defining the policy requirements. Which of the following are valid considerations when configuring adaptive threat profiling policies? (Select all that apply.)

   • AIntegrate profiling alerts with other ATP Cloud features for correlated incident response.
   • BDisable profiling for privileged users because they are trusted.
   • CUse a single global policy for all users to simplify management.
   • DSet the anomaly threshold high enough to avoid false positives, but low enough to detect real anomalies.
   • EDefine separate policies for different user groups to account for role-based behavior.
   Check answers Discussion Select an answer first