5.3 Explain the Concept of User and Entity Behavior Analytics (UEBA) CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A UEBA system has been monitoring a user for several weeks. The user typically accesses a CRM system from 9 AM to 5 PM and downloads small reports. This week, the user accessed the CRM at 11 PM and downloaded a large customer database. The UEBA system flags this as an anomaly. What is the most likely reason for this flag?

   • AThe CRM system has a known vulnerability that was exploited
   • BThe user's account has been flagged by threat intelligence as compromised
   • CThe activity deviates from the user's established baseline in terms of time and data volume
   • DThe user's download exceeded a predefined static threshold
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A UEBA system assigns risk scores to users based on their activities. A user who typically works 9-to-5 suddenly logs in at 3:00 AM and attempts to access a database they have never touched. The system raises the user's risk score. What is the primary purpose of this risk score?

   • ATo replace the need for manual security monitoring
   • BTo automatically block the user's access to all systems
   • CTo determine the exact type of malware used in an attack
   • DTo help security teams prioritize which alerts to investigate first
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of an anomaly that UEBA might detect?

   • AA user accessing a commonly used internal website
   • BA user changing their password after a security policy update
   • CA user logging in from a new location at an unusual time
   • DA user sending an email to a colleague
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A UEBA system is configured to assign risk scores based on anomalies. A user who is a system administrator has a high-risk score because they frequently perform privileged actions, such as creating new user accounts and modifying system configurations. However, these actions are part of their normal job. The security team is concerned that the high score is causing unnecessary alerts. What is the best way to address this issue?

   • ARefine the baseline to recognize the administrator's privileged actions as normal for their role
   • BIncrease the risk score for all users to make the administrator's score less prominent
   • CLower the risk score threshold for all users to reduce the number of alerts
   • DExclude the administrator's account from UEBA monitoring
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why does UEBA use multiple types of data sources?

   • ATo eliminate the need for human analysts
   • BTo gain a more complete picture of user and entity behavior
   • CTo simplify the deployment of endpoint agents
   • DTo reduce the need for encryption
   Reveal Solution Discussion Select an answer first