5.3 Explain the Concept of User and Entity Behavior Analytics (UEBA) CYBERSECURITY-PRACTITIONER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the purpose of a risk score in UEBA?

   • ATo measure the performance of the UEBA system itself
   • BTo rank the severity of anomalous activities and prioritize responses
   • CTo calculate the number of false positives generated
   • DTo determine the encryption strength needed for user data
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst is explaining to management why the company should invest in UEBA in addition to their existing firewall and antivirus. Which statement best describes the unique value of UEBA?

   • AUEBA detects threats by learning normal behavior and identifying deviations, which can catch attacks that bypass signature-based controls
   • BUEBA only works with cloud-based applications, so it is not applicable to on-premises environments
   • CUEBA replaces the firewall and antivirus, so the company can reduce its security stack
   • DUEBA blocks all malicious traffic before it reaches the network
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company's UEBA system flags two events: (1) a user accessing a shared drive after hours, and (2) the same user downloading a large volume of sensitive files and then attempting to send them to an external email address. The UEBA system assigns a higher risk score to the second event. What is the most likely reason for this difference?

   • AThe second event involves multiple anomalous activities that together indicate a higher likelihood of malicious intent
   • BThe UEBA system only scores events that involve external communication
   • CThe first event is not a deviation from the user's baseline
   • DThe second event matches a known malware signature
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's security team is evaluating whether to use UEBA or a traditional SIEM with static rules to detect insider threats. They want to identify employees who access data outside their normal job function. What is the key advantage of UEBA over the static-rule SIEM?

   • AUEBA learns individual baselines and can detect subtle deviations that static rules might miss
   • BUEBA does not require any data sources to operate
   • CUEBA can block malicious activity in real time
   • DUEBA is faster at processing logs than a traditional SIEM
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How can UEBA help in detecting insider threats?

   • ABy scanning emails for known malware attachments
   • BBy enforcing password complexity requirements
   • CBy blocking all external network connections
   • DBy identifying employees who access data or systems outside their normal patterns
   Reveal Solution Discussion Select an answer first