Adaptive Threat Profiling JN0-336 Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A regional bank uses Juniper ATP Cloud to protect its internet-facing web applications. The security team wants to reduce false positives from static signature-based detection by focusing on deviations from each application's normal behavior. Which approach should the team implement?

   • AConfigure the ATP Cloud to block all traffic that does not match a known signature.
   • BDeploy additional firewalls to segment the web applications from the rest of the network.
   • CEnable adaptive threat profiling to establish a behavioral baseline for each application and alert on anomalies.
   • DIncrease the sensitivity of all existing signature-based rules to catch more anomalies.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary purpose of adaptive threat profiling in Juniper ATP Cloud?

   • ATo establish a baseline of normal network behavior and then identify deviations that may indicate a threat
   • BTo replace traditional signature-based detection with a static list of known malicious file hashes
   • CTo automatically block all traffic that does not match a predefined set of security policies
   • DTo provide a manual process for security analysts to review logs and identify threats
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst reviews the ATP Cloud dashboard and sees a spike in alerts for a specific application. The alerts indicate that the application is making connections to a new external IP address. What should the analyst do first to assess the severity?

   • ACheck the profiling report for the application to see if the new IP is a deviation from its baseline.
   • BImmediately block the external IP address in the firewall.
   • CIncrease the profiling sensitivity to get more details.
   • DIgnore the alerts because they are from profiling.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company's ATP Cloud has been profiling a user account for three weeks. The user suddenly starts accessing file shares at 3:00 AM, a behavior never seen before. How does adaptive threat profiling treat this event?

   • AIt adds the behavior to the baseline automatically without alerting.
   • BIt blocks the access immediately without any analysis.
   • CIt ignores the event because the user is authenticated.
   • DIt compares the event against the user's established behavioral baseline and flags it as an anomaly.
   Reveal Solution Discussion Select an answer first