5.3 Explain the Concept of User and Entity Behavior Analytics (UEBA) CYBERSECURITY-PRACTITIONER Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A UEBA system is being configured for a hospital where nurses typically access patient records from workstations on the same floor during their shifts. The system needs to learn what is normal for each nurse. Which approach is most effective for establishing this baseline?

   • AUsing a single global baseline for all users based on industry averages
   • BImmediately flagging any access that occurs outside business hours
   • CCollecting and analyzing historical access logs, including times, locations, and data accessed, over a period of weeks
   • DDefining static rules that specify allowed access times and locations for all nurses
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary method UEBA uses to detect a potential threat?

   • AScanning files for known malware signatures
   • BComparing current behavior against the established baseline to identify significant deviations
   • CBlocking all traffic from unknown IP addresses
   • DRequiring multi-factor authentication for all users
   Reveal Solution Discussion Select an answer first