5.3 Explain the Concept of User and Entity Behavior Analytics (UEBA) CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company is deploying UEBA and must decide which data sources to integrate. They have limited budget and can only integrate a few sources initially. They want to detect both insider threats and compromised accounts. Which data source combination would provide the most value for both use cases?

   • AOnly network traffic logs
   • BAuthentication logs and data access logs
   • COnly endpoint process logs
   • DAuthentication logs and network traffic logs
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company wants to implement UEBA to detect both insider threats and compromised accounts. They are deciding which data sources to integrate. Which combination of data sources would provide the most comprehensive behavioral coverage?

   • AOnly authentication logs, since login anomalies are the primary indicator
   • BOnly network traffic flows, since they capture all user activity
   • CAuthentication logs, network traffic flows, endpoint process events, and data access logs
   • DOnly endpoint process events, since they show what users are doing on their machines
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team wants to deploy UEBA to detect compromised accounts. They plan to feed the UEBA system with authentication logs, network flow data, and endpoint process execution events. Which statement best describes the role of these data sources in UEBA?

   • AThey are only useful for detecting insider threats, not compromised accounts
   • BThey replace the need for traditional antivirus signatures
   • CThey provide the raw behavioral signals that UEBA analyzes to establish baselines and detect anomalies
   • DThey are used to block malicious traffic before it reaches the endpoint
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   How does UEBA typically determine the risk score for a user?

   • ABy aggregating the severity and frequency of anomalous activities associated with that user
   • BBy evaluating the user's password strength
   • CBy counting the number of security alerts generated by the user's antivirus software
   • DBy measuring the user's network bandwidth consumption
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is UEBA considered more effective than signature-based security for detecting insider threats?

   • ABecause UEBA can block all malicious traffic before it reaches the endpoint
   • BBecause insider threats often involve legitimate credentials and do not match known signatures
   • CBecause UEBA does not require any data collection
   • DBecause signature-based security cannot be deployed on endpoints
   Reveal Solution Discussion Select an answer first