5.3 Explain the Concept of User and Entity Behavior Analytics (UEBA) CYBERSECURITY-PRACTITIONER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company's UEBA system alerts on an employee who has been downloading large amounts of data every day for a week, but the employee's job role requires them to access large datasets for a data migration project. The security team is reviewing the alert. What is the most appropriate action?

   • AIncrease the employee's risk score permanently to reflect the new behavior
   • BIgnore the alert because the employee has a valid reason for the downloads
   • CImmediately suspend the employee's account to prevent further data loss
   • DVerify the employee's job responsibilities and the legitimacy of the data access before escalating
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security team is debating whether to use UEBA or a traditional signature-based antivirus to detect a new type of malware that uses legitimate system tools to perform malicious actions. The malware does not have a known signature. Which approach would be more effective, and why?

   • ABoth are equally effective, since they use the same detection methods
   • BUEBA, because it can detect the malware by identifying unusual behavior, such as a user running system tools at odd times or in unusual combinations
   • CNeither approach can detect this type of malware
   • DSignature-based antivirus, because it can detect the malware by matching its file hash
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization is concerned about insider threats, particularly employees who might access sensitive data outside of their normal job functions. They want to implement a system that can identify such behavior early. Which UEBA use case is most directly applicable to this concern?

   • AMalware detection by matching files against known signatures
   • BNetwork intrusion prevention by blocking suspicious traffic
   • CCompromised account identification by detecting login anomalies
   • DInsider threat detection by identifying users who access data or systems outside their normal pattern
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security architect is planning a UEBA deployment and needs to ensure the system has enough data to detect anomalies effectively. Which data source is most critical for detecting a compromised account where an attacker uses stolen credentials?

   • ANetwork traffic logs that show communication patterns
   • BAuthentication logs that record login times, locations, and devices
   • CData access logs that show file downloads
   • DEndpoint process logs that show running applications
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team has deployed UEBA and is seeing a high number of false positives. The system flags users who work late occasionally or access new systems as part of their job. The team wants to reduce false positives without missing real threats. Which approach is most effective?

   • ASwitch to a signature-based detection system to eliminate false positives
   • BIncrease the risk score threshold for all alerts to reduce the number of notifications
   • CDisable alerts for users who have never been compromised
   • DTune the UEBA system's anomaly thresholds and allow the baseline to adapt over time
   Reveal Solution Discussion Select an answer first