5.3 Explain the Concept of User and Entity Behavior Analytics (UEBA) CYBERSECURITY-PRACTITIONER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A UEBA system has been running for a month and has established baselines for all users. Today, it flags a user who has never accessed a particular file server before, but the user is a senior manager who frequently accesses other servers. What is the most appropriate immediate action for the security team?

   • AIgnore the alert because the user is a senior manager and likely has legitimate access
   • BImmediately block the user's account to prevent further access
   • CUpdate the baseline to include this new access pattern
   • DInvestigate the alert to determine if the access is legitimate or a sign of compromise
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a common data source for UEBA?

   • AMarketing analytics reports
   • BEndpoint event logs
   • CPhysical access control lists
   • DEmployee satisfaction surveys
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst at a financial firm notices that a user who typically accesses the internal HR portal only during business hours from a company workstation has recently logged in at 2:00 AM from an IP address in a foreign country and downloaded a large volume of customer records. The analyst wants to detect such activities automatically in the future. Which UEBA capability is most directly responsible for flagging this behavior?

   • AMatching the login attempt against a database of known malware signatures
   • BCorrelating the login with threat intelligence feeds to identify the attacker
   • CBlocking all access to customer records from foreign IP addresses
   • DEstablishing a baseline of normal access patterns and detecting deviations from it
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of User and Entity Behavior Analytics (UEBA) in endpoint security?

   • ATo enforce access control policies based on user roles and permissions
   • BTo identify potentially malicious activities by analyzing deviations from established behavioral norms
   • CTo replace traditional antivirus by blocking known malware signatures
   • DTo encrypt data at rest and in transit to protect sensitive information
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company currently relies solely on signature-based antivirus to protect endpoints. They are experiencing incidents where employees' credentials are stolen and used to access sensitive data, but the antivirus does not detect these incidents. The security manager wants to adopt UEBA to address this gap. What is the primary advantage of UEBA over the existing signature-based approach?

   • AUEBA can detect suspicious behavior even when no known malware signature is involved
   • BUEBA can block all malicious traffic before it reaches the endpoint
   • CUEBA only focuses on network traffic, making it more efficient
   • DUEBA eliminates the need for other security controls
   Reveal Solution Discussion Select an answer first