I85PREP
⌘ K
Exabeam Analyst study materials
Exabeam Analyst study resources

Exabeam Analyst practice questions

One question at a time. Build your Exabeam Analyst understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat detection, investigation, and response (TDIR)

In Exabeam Advanced Analytics, what does a session represent in the context of TDIR?

  1. A normalized sequence of related events tied to a user or asset over time Correct answer.
  2. A scheduled report exported to a SIEM
  3. A rule that blocks traffic at the perimeter
  4. A single raw log line ingested from a firewall

Explanation

Exabeam builds sessions by grouping related events for a user or asset into a chronological narrative, which is the core unit analysts review during investigation. Raw log lines are inputs, not the session itself, and blocking or reporting are separate functions.

Question 2Threat detection, investigation, and response (TDIR)

An analyst wants Exabeam to flag a user who logs in from a new country for the first time. Which concept best supports this detection?

  1. Disabling all remote access entirely
  2. A baseline of normal behavior with anomaly scoring on deviation Correct answer.
  3. A manual weekly review of authentication logs
  4. A static deny list of every foreign IP range

Explanation

Exabeam's value comes from behavioral baselines that learn what is normal per user and entity, then score deviations such as an unprecedented geolocation. Static lists and manual review do not scale and miss novel behavior.

Question 3Threat detection, investigation, and response (TDIR)

What is the primary purpose of a risk score attached to a user in Exabeam?

  1. To permanently disable the account automatically
  2. To encrypt the user's authentication traffic
  3. To replace the need for any log correlation
  4. To prioritize which entities and sessions analysts should investigate first Correct answer.

Explanation

Risk scoring aggregates anomalous behavior so analysts can triage the highest-risk users and sessions first. It is a prioritization aid, not an enforcement or encryption mechanism.

Question 4Threat detection, investigation, and response (TDIR)

During investigation, an analyst sees a session with many low-severity anomalies that together produce a high risk score. What does this pattern most likely indicate?

  1. A logging outage affecting a single sensor
  2. A guaranteed false positive that should be closed immediately
  3. Normal activity that requires no review
  4. Cumulative anomalous behavior that may represent a slow, low-and-slow attack Correct answer.

Explanation

Exabeam aggregates multiple weak signals, and their combination can reveal a low-and-slow campaign that no single event would expose. Closing it as a false positive without review risks missing a real intrusion.

Question 5Threat detection, investigation, and response (TDIR)

Which Exabeam capability helps an analyst understand the sequence of actions a compromised account took before and after a suspicious login?

  1. The timeline view of the user's session Correct answer.
  2. The firewall rule editor
  3. The asset inventory export
  4. The license usage dashboard

Explanation

The timeline presents correlated events in chronological order, letting analysts reconstruct attacker actions around a key event like a suspicious login. Other dashboards do not provide the behavioral narrative.

Question 6Threat detection, investigation, and response (TDIR)

An analyst is triaging an alert and needs to decide whether activity is malicious. Which step best reflects the TDIR investigation phase?

  1. Correlating related events and context to determine scope and impact Correct answer.
  2. Ignoring the alert until the next shift
  3. Immediately deleting the user account
  4. Disabling the entire network segment

Explanation

Investigation means gathering correlated context to establish whether activity is malicious and how far it spread. Destructive or broad actions belong to response and should follow, not replace, investigation.

Question 7Threat detection, investigation, and response (TDIR)

What role does user and entity context (such as department, peer group, and normal working hours) play in Exabeam detection?

  1. It guarantees zero false positives
  2. It encrypts session data at rest
  3. It replaces the need for authentication logs
  4. It shapes the baseline so anomalies are judged relative to the entity's own norms Correct answer.

Explanation

Context such as peer group and typical hours allows Exabeam to compare behavior against relevant norms, making anomaly detection more accurate. It does not encrypt data, replace logs, or eliminate all false positives.

Question 8Threat detection, investigation, and response (TDIR)

An analyst observes a service account authenticating interactively from a workstation at 3 a.m. Why is this suspicious in Exabeam terms?

  1. It deviates from the account's normal non-interactive, machine-driven pattern Correct answer.
  2. Night-time activity is always benign
  3. Service accounts never generate logs
  4. Workstations cannot authenticate to domains

Explanation

Service accounts typically run non-interactively from servers, so interactive logons from a workstation at unusual hours deviate from baseline and may indicate credential misuse. The other statements are factually wrong.

Question 9Threat detection, investigation, and response (TDIR)

Which action belongs to the response phase of TDIR rather than detection or investigation?

  1. Correlating logs across sources
  2. Containing a compromised host by isolating it from the network Correct answer.
  3. Scoring a session's anomaly
  4. Reviewing a timeline of events

Explanation

Containment is a response action taken after detection and investigation establish a threat. Reviewing timelines, scoring, and correlating are detection or investigation activities.

Question 10Threat detection, investigation, and response (TDIR)

An analyst sees a spike in failed logins followed by a successful login for the same user. What is the most appropriate interpretation during triage?

  1. A possible brute-force or password-spray attempt that succeeded and warrants escalation Correct answer.
  2. A benign password reset that needs no review
  3. A routine backup job completing
  4. A network latency issue affecting authentication

Explanation

Repeated failures ending in success is a classic signature of brute force or spraying that may have succeeded, so it should be escalated for deeper investigation. The pattern is not explained by resets, latency, or backups.

Question 11Threat detection, investigation, and response (TDIR)

Why does Exabeam emphasize correlating events across multiple data sources rather than analyzing each in isolation?

  1. It eliminates the need for analyst judgment
  2. Cross-source correlation reveals attack chains that single-source alerts would miss Correct answer.
  3. It automatically patches vulnerable systems
  4. It reduces the number of logs that must be stored

Explanation

Attackers move across systems, so correlating identity, endpoint, and network events exposes chains that isolated alerts hide. Correlation does not patch systems or remove the need for human analysis.

Question 12Threat detection, investigation, and response (TDIR)

An analyst is prioritizing alerts and has limited time. Which approach aligns with risk-based triage in Exabeam?

  1. Review only alerts from a single log source
  2. Sort alphabetically by username
  3. Focus first on high-risk sessions with multiple correlated anomalies Correct answer.
  4. Start with the oldest alerts regardless of risk

Explanation

Risk-based triage directs limited analyst time to the sessions most likely to represent real threats, typically those with high aggregate risk and multiple anomalies. Arbitrary ordering ignores risk signals.

Question 13Threat detection, investigation, and response (TDIR)

What does an anomaly in Exabeam's behavioral model most accurately describe?

  1. A deviation from an entity's learned normal behavior Correct answer.
  2. A policy violation by definition
  3. A confirmed security incident
  4. A hardware failure event

Explanation

An anomaly is a statistical deviation from learned norms and is a signal, not a confirmed incident. Investigation determines whether it reflects malicious activity or benign change.

Question 14Threat detection, investigation, and response (TDIR)

An analyst notices a user accessing an unusually large number of files shortly before their last day of employment. Which combination best supports a data-exfiltration hypothesis?

  1. A single failed login plus a software update
  2. Routine backup logs plus a printer error
  3. Abnormal file-access volume plus an upcoming termination context Correct answer.
  4. Normal file access plus a password change

Explanation

Mass file access combined with termination context is a recognized insider-threat pattern that strengthens an exfiltration hypothesis. The other combinations lack the volume and context that indicate risk.

Question 15Threat detection, investigation, and response (TDIR)

Which statement best describes how Exabeam uses peer groups in anomaly detection?

  1. It assigns static risk scores that never change
  2. It encrypts peer communications
  3. It groups users by password length for reporting
  4. It compares an entity's activity against similar peers to flag unusual behavior Correct answer.

Explanation

Peer grouping lets the model judge whether activity is unusual relative to comparable users, improving detection sensitivity. It is unrelated to passwords, encryption, or static scoring.

Question 16Threat detection, investigation, and response (TDIR)

After confirming a malicious session, an analyst must document findings for the response team. Which element is most essential to include?

  1. The color scheme of the dashboard
  2. The analyst's lunch schedule
  3. The number of dashboard widgets used
  4. Affected entities, observed timeline, and evidence supporting the conclusion Correct answer.

Explanation

Effective handoff documentation captures who and what was affected, when events occurred, and the evidence that justifies the conclusion. Cosmetic or personal details are irrelevant to responders.

Question 17Threat detection, investigation, and response (TDIR)

An analyst sees a session where a user's credentials are used from two geographically distant locations within minutes. What does this most likely suggest?

  1. Possible credential compromise with concurrent use by an attacker Correct answer.
  2. A routine single sign-on refresh
  3. A time-zone display bug only
  4. Normal travel between the two cities

Explanation

Impossible-travel patterns within minutes strongly suggest credentials are being used by more than one party, often an attacker. Physical travel cannot account for near-simultaneous distant logins.

Question 18Threat detection, investigation, and response (TDIR)

What is the benefit of Exabeam automatically stitching events into a session timeline for investigation?

  1. It removes the need to collect logs
  2. It guarantees the attacker is identified
  3. It blocks malicious traffic automatically
  4. It reduces manual effort to reconstruct what happened and when Correct answer.

Explanation

Automatic session stitching saves analysts from manually correlating timestamps across sources, accelerating reconstruction. It does not identify attackers with certainty, block traffic, or eliminate log collection.

Question 19Threat detection, investigation, and response (TDIR)

Which scenario best demonstrates the detection phase of TDIR?

  1. An anomaly rule fires on unusual privileged-account activity Correct answer.
  2. A patch is deployed to close a vulnerability
  3. An analyst isolates a server
  4. A team writes a post-incident report

Explanation

Detection is the phase where monitoring and analytics surface suspicious activity, such as a rule firing on anomalous privileged activity. Isolation, reporting, and patching belong to later phases.

Question 20Threat detection, investigation, and response (TDIR)

An analyst must distinguish a genuine insider-threat case from a benign anomaly. Which evidence most strengthens the malicious interpretation?

  1. Repeated access to sensitive repositories outside the user's role over several days Correct answer.
  2. A routine password change prompt
  3. A login during standard business hours
  4. A one-time access to a shared drive the user normally uses

Explanation

Repeated access to sensitive data outside the user's role and normal pattern is a strong malicious indicator. Single normal accesses, standard-hours logins, and password prompts are routine.

Question 21Threat detection, investigation, and response (TDIR)

In Exabeam, why is it important to tune or review behavioral models over time?

  1. Environments and job roles change, so baselines must stay relevant to avoid noisy alerts Correct answer.
  2. Models never change after deployment
  3. Tuning permanently disables detection
  4. Baselines are only used for reporting

Explanation

As users change roles and infrastructure evolves, stale baselines produce false positives or missed detections, so periodic review keeps models relevant. Models do not remain static, and tuning does not disable detection.

Question 22Threat detection, investigation, and response (TDIR)

An analyst finds a session with a single high-severity anomaly but no supporting context. What is the most defensible next step?

  1. Delete the user's data
  2. Gather additional correlated evidence before concluding it is malicious Correct answer.
  3. Close the alert without review
  4. Immediately declare a confirmed breach

Explanation

A single anomaly without corroboration may be benign, so analysts should gather correlated evidence before drawing conclusions. Declaring a breach, ignoring the alert, or destroying data are unjustified.

Question 23Threat detection, investigation, and response (TDIR)

Which Exabeam concept directly supports identifying that a user's behavior changed after a role transition?

  1. Comparing recent activity against the user's historical baseline Correct answer.
  2. Ignoring the peer group entirely
  3. Relying on a static allow list
  4. Disabling the user's account

Explanation

Historical baselines let analysts see how behavior shifted over time, which is useful after role changes. Static lists, account disabling, and ignoring peers do not reveal behavioral change.

Question 24Threat detection, investigation, and response (TDIR)

A security team wants to reduce mean time to respond (MTTR). Which Exabeam-enabled practice most directly supports this goal?

  1. Increasing the number of unprioritized alerts
  2. Removing all behavioral baselines
  3. Collecting more raw logs without analysis
  4. Using risk-prioritized, context-rich sessions to accelerate triage and handoff Correct answer.

Explanation

Risk-prioritized, context-rich sessions help analysts reach conclusions faster and hand off clear findings, directly reducing MTTR. More unanalyzed logs or alerts increase workload rather than speed response.

Question 25Threat detection, investigation, and response (TDIR)

Which statement about the relationship between detection and investigation is most accurate?

  1. Detection and investigation are the same activity
  2. Investigation always precedes detection
  3. Detection surfaces candidate activity, and investigation establishes whether and how it is malicious Correct answer.
  4. Investigation replaces the need for detection

Explanation

Detection generates leads, while investigation validates and scopes them using correlated context. Investigation cannot precede detection, and the two are distinct but complementary phases.

Question 26Threat detection, investigation, and response (TDIR)

In Exabeam, what does a risk score assigned to a user or session represent?

  1. The percentage of the entity's baseline behaviors that remained unchanged
  2. The count of raw log events collected for the entity during the scoring window
  3. The aggregate likelihood that the associated activity is malicious, weighted by the severity of the anomalies observed Correct answer.
  4. The number of peer-group members that triggered the same rule

Explanation

Exabeam's risk scoring aggregates anomaly detections, each weighted by its severity and relevance, into a single prioritized value. It is not a raw event count or a measure of baseline stability; it expresses how likely the session or user is to be malicious so analysts can triage by risk.

Question 27Threat detection, investigation, and response (TDIR)

Which Exabeam capability primarily enables an analyst to reconstruct the full sequence of activity tied to a single user across multiple log sources?

  1. Vulnerability scanning of endpoints
  2. Session stitching into a unified timeline Correct answer.
  3. Raw log search with keyword filters
  4. Rule-based correlation of alerts into incidents

Explanation

Session stitching groups related events from disparate sources into a single chronological timeline for an entity, which is the foundation for investigation. Alert correlation and keyword search help locate data, but the stitched session timeline is what reconstructs the activity sequence.

Question 28Threat detection, investigation, and response (TDIR)

An analyst is reviewing a session and wants to understand why Exabeam flagged a particular event. What is the most direct way to obtain that reasoning?

  1. Open the anomaly detail associated with the event to see the triggered model and its baseline comparison Correct answer.
  2. Ask the peer group owner to confirm the user's schedule
  3. Re-run the raw log ingestion for the affected source
  4. Export the session to CSV and sort by timestamp

Explanation

Each anomaly in Exabeam carries the model that fired and the baseline or peer comparison that produced it, so the anomaly detail is the authoritative explanation. Re-ingestion, exports, and manual confirmation do not reveal the model's reasoning.

Question 29Threat detection, investigation, and response (TDIR)

Which data source type is most valuable for detecting lateral movement between internal hosts?

  1. Physical badge reader logs
  2. Public DNS zone transfers
  3. Endpoint process and network connection telemetry Correct answer.
  4. Marketing email gateway logs

Explanation

Lateral movement involves authentication and connection activity between internal hosts, which endpoint process and network connection telemetry captures directly. DNS zone transfers, email gateway logs, and badge logs do not record host-to-host session activity.

Question 30Threat detection, investigation, and response (TDIR)

An analyst wants to see how a user's behavior on a given day compares with what is normal for that user. Which Exabeam feature is designed for this?

  1. The threat intelligence feed
  2. The user's behavioral baseline and its associated anomaly models Correct answer.
  3. The case management queue
  4. The data source health dashboard

Explanation

Exabeam builds a behavioral baseline per user and applies anomaly models that compare current activity against that baseline. Threat intelligence, case queues, and source health dashboards serve different purposes and do not compare activity to the user's normal behavior.

Question 31Threat detection, investigation, and response (TDIR)

During investigation, an analyst finds a session with high risk driven by an impossible-travel anomaly and a concurrent privileged command. What is the most appropriate next action?

  1. Suppress the anomaly model to reduce future noise
  2. Close the session as a false positive because travel anomalies are common
  3. Wait for the next scheduled report before acting
  4. Escalate for response while gathering corroborating authentication and endpoint evidence Correct answer.

Explanation

Combining a high-severity anomaly with corroborating privileged activity warrants escalation and evidence gathering before containment decisions. Dismissing, suppressing, or delaying ignores the converging signals that make the session risky.

Question 32Threat detection, investigation, and response (TDIR)

Which statement best describes the purpose of Exabeam's correlation rules relative to its behavioral models?

  1. Rules and models cannot both contribute to the same session's risk
  2. Models only operate on network flow data
  3. Rules replace behavioral models entirely when enabled
  4. Rules encode known patterns while models detect deviations from learned baselines Correct answer.

Explanation

Correlation rules capture known conditions or sequences, while behavioral models surface deviations from learned norms; together they enrich the same session. Rules do not replace models, models span many data types, and both can add risk to one session.

Question 33Threat detection, investigation, and response (TDIR)

An analyst is documenting a confirmed incident for the response team. Which detail most directly supports containment actions?

  1. The total number of dashboards viewed
  2. The time the analyst logged in that morning
  3. The analyst's personal opinion of the user
  4. The specific accounts, hosts, and indicators involved in the malicious activity Correct answer.

Explanation

Containment requires knowing exactly which accounts, hosts, and indicators are implicated so responders can isolate and remediate precisely. Opinions, dashboard counts, and analyst login times do not guide containment.

Question 34Threat detection, investigation, and response (TDIR)

An analyst observes a user account authenticating successfully from a new country, then immediately creating a new mailbox rule that forwards mail externally. Which interpretation is most defensible?

  1. This is a benign configuration change because mailbox rules are routine
  2. The sequence suggests possible account compromise with data exfiltration intent and should be investigated Correct answer.
  3. It is a false positive because the login succeeded
  4. It should be ignored because email rules are outside TDIR scope

Explanation

A new-country login followed by external mail forwarding is a recognized pattern of account takeover and exfiltration. Routine rule creation does not explain the combination with an anomalous login, so investigation is warranted.

Question 35Threat detection, investigation, and response (TDIR)

When prioritizing among many sessions, which combination of factors should an analyst weigh most heavily?

  1. Risk score magnitude together with the criticality of the affected asset and user Correct answer.
  2. The number of events in each session only
  3. The alphabetical order of usernames
  4. The age of the data source connectors

Explanation

Risk-based prioritization combines the session's risk with business context such as asset and user criticality, because a moderate anomaly on a critical asset can matter more than a high anomaly on a low-value one. Alphabetical order, raw event counts, and connector age do not reflect impact.

Question 36Threat detection, investigation, and response (TDIR)

An analyst needs to determine whether a suspicious login originated from a known malicious IP. Which Exabeam enrichment is most relevant?

  1. Session timeout settings
  2. User peer-group assignment
  3. Data source parsing rules
  4. Threat intelligence matching on the source IP Correct answer.

Explanation

Threat intelligence enrichment compares observed indicators such as source IPs against known-bad feeds to add context and risk. Peer groups, parsing rules, and timeouts influence modeling or ingestion but do not identify known malicious addresses.

Question 37Threat detection, investigation, and response (TDIR)

A user's normal working hours are 09:00 to 18:00 local time. Exabeam flags a 02:00 VPN login from that user. Which factor most determines whether this is a true positive?

  1. Whether the user's role or on-call schedule plausibly explains off-hours access, corroborated by subsequent activity Correct answer.
  2. Whether the login used a password or certificate
  3. Whether the analyst personally knows the user
  4. Whether the VPN client version is current

Explanation

Off-hours access is only anomalous if the user's role, on-call duties, or travel do not explain it, so context and subsequent activity determine whether the flag is a true positive. Client version, authentication method, and analyst familiarity do not resolve the anomaly.

Question 38Threat detection, investigation, and response (TDIR)

Which investigation step best tests whether a spike in data downloads by a user is anomalous rather than normal for their role?

  1. Review the firewall's uptime
  2. Compare the volume against the user's historical baseline and that of their peer group Correct answer.
  3. Confirm the user's password complexity policy
  4. Check whether the file server is patched

Explanation

Anomaly determination requires comparing the observed volume against the user's own history and against comparable peers. Patching, password policy, and firewall uptime are unrelated to whether the download volume is unusual.

Question 39Threat detection, investigation, and response (TDIR)

An analyst sees a session where a service account performs its first-ever interactive logon to a server it has never touched. Which conclusion is best supported?

  1. The account must be disabled immediately without further review
  2. The event should be filtered out because service accounts are excluded from modeling
  3. The deviation from the account's established pattern is suspicious and warrants investigation Correct answer.
  4. The activity is normal because service accounts frequently log on interactively

Explanation

Service accounts typically follow stable, non-interactive patterns, so a first interactive logon to a new host is a meaningful deviation worth investigating. Immediate disabling without review risks disruption, and service accounts are not excluded from modeling.

Question 40Threat detection, investigation, and response (TDIR)

What is the primary benefit of mapping detected activity to a framework such as MITRE ATT&CK during investigation?

  1. It provides a common vocabulary for adversary techniques that guides coverage assessment and response Correct answer.
  2. It guarantees the alert is a true positive
  3. It encrypts the session data
  4. It replaces the need for risk scoring

Explanation

ATT&CK mapping gives analysts a shared vocabulary for adversary techniques, which helps assess detection coverage and plan response. It does not replace risk scoring, guarantee true positives, or affect encryption.

Question 41Threat detection, investigation, and response (TDIR)

An analyst is deciding whether to contain a suspected compromised endpoint. Which consideration most appropriately balances risk during this decision?

  1. The color scheme of the analyst console
  2. The number of open browser tabs on the endpoint
  3. The length of the username
  4. The potential business impact of isolation versus the confirmed evidence of compromise Correct answer.

Explanation

Containment decisions weigh the confirmed evidence against the operational cost of isolating the asset, since premature isolation can disrupt critical services. Cosmetic, incidental, and naming details do not inform this trade-off.

Question 42Threat detection, investigation, and response (TDIR)

Which practice most improves the quality of an investigation report produced after a confirmed incident?

  1. Including a chronological narrative tied to evidence, affected entities, and actions taken Correct answer.
  2. Using vague descriptions to avoid committing to details
  3. Recording only the final conclusion without supporting evidence
  4. Omitting timestamps to keep the report short

Explanation

A strong report ties a chronological narrative to concrete evidence, identifies affected entities, and documents the actions taken so others can verify and act. Omitting timestamps, evidence, or specifics undermines the report's usefulness.

Question 43Threat detection, investigation, and response (TDIR)

An analyst notices that a single anomaly model generates many low-value alerts for a department with unusual but legitimate workflows. What is the most appropriate tuning approach?

  1. Adjust the model or add contextual exclusions scoped to that department while preserving coverage elsewhere Correct answer.
  2. Disable the model globally for all users
  3. Delete the department's data sources
  4. Ignore all alerts from that model permanently

Explanation

Scoped tuning addresses the noise source while retaining detection for other populations, which is the balanced approach. Global disabling, permanent ignoring, or removing data sources sacrifices coverage and visibility.

Question 44Threat detection, investigation, and response (TDIR)

Which scenario most clearly indicates a need to escalate from investigation to active response?

  1. A confirmed malicious process is executing on a production server with active outbound connections Correct answer.
  2. A scheduled backup completes successfully
  3. A user changes their display name in the directory
  4. A user logs in during normal hours from their usual workstation

Explanation

Confirmed malicious execution with active outbound connections indicates an ongoing compromise that requires response to stop further damage. Normal logins, cosmetic directory changes, and successful backups do not require incident response.

Question 45Threat detection, investigation, and response (TDIR)

An analyst must explain to leadership why a session with many anomalies received a moderate risk score rather than a high one. Which explanation is most accurate?

  1. Risk is based solely on the number of anomalies regardless of severity
  2. Risk scores are random and cannot be explained
  3. Risk is determined by the analyst's seniority
  4. Risk reflects the weighted severity and confidence of anomalies, so many low-severity deviations can total less than a few high-severity ones Correct answer.

Explanation

Exabeam weights each anomaly by severity and relevance, so numerous minor deviations may sum to less risk than a small number of severe ones. Risk is deterministic and explainable, not random or based on analyst seniority.

Question 46Threat detection, investigation, and response (TDIR)

A session shows a legitimate-looking login followed by a series of low-and-slow reconnaissance commands spread over hours. Why might behavioral modeling detect this when a simple threshold rule would not?

  1. Threshold rules cannot be configured for logins
  2. Threshold rules are always more accurate than models
  3. Modeling only inspects the first event of a session
  4. Modeling compares the sequence and pattern against learned norms, catching distributed deviations that stay below per-event thresholds Correct answer.

Explanation

Low-and-slow activity is designed to stay under per-event thresholds, but behavioral models evaluate patterns and sequences relative to learned baselines, surfacing distributed deviations. Threshold rules remain useful but are not inherently more accurate, and modeling does not inspect only the first event.

Question 47Threat detection, investigation, and response (TDIR)

An analyst finds that a high-risk session is driven largely by a single rare-but-benign administrative tool execution. What is the most rigorous way to validate before closing it?

  1. Corroborate with change records, the user's role, and related activity before concluding it is benign Correct answer.
  2. Suppress the tool across the environment
  3. Close it immediately because rare tools are always benign
  4. Escalate to response without any validation

Explanation

Rarity alone does not establish benignity or malice; validation requires corroborating evidence such as change records, role appropriateness, and related activity. Immediate closure, broad suppression, or unvalidated escalation all bypass that evidence.

Question 48Threat detection, investigation, and response (TDIR)

A team wants to measure whether its TDIR process is improving detection quality over time. Which metric set is most appropriate?

  1. Total storage consumed by raw logs
  2. Count of analyst coffee breaks
  3. True-positive rate, false-positive rate, and time from detection to containment Correct answer.
  4. Number of dashboards created and deleted

Explanation

Detection quality and response efficiency are best measured by true- and false-positive rates together with detection-to-containment time. Dashboard churn, break counts, and storage consumption do not reflect detection or response effectiveness.

Question 49Threat detection, investigation, and response (TDIR)

During an investigation, an analyst discovers that a user's credentials were used from two different devices with conflicting operating systems within the same hour. Which hypothesis is most strongly supported?

  1. The logs are necessarily corrupted
  2. Credential sharing or theft is likely and should be investigated Correct answer.
  3. The anomaly model is malfunctioning
  4. The user legitimately upgraded their device mid-hour

Explanation

Simultaneous use of the same credentials across conflicting devices points to shared or stolen credentials rather than a legitimate upgrade. Log corruption or model malfunction is possible but less likely than credential misuse and should be ruled out with evidence.

Question 50Threat detection, investigation, and response (TDIR)

An analyst is reviewing a session where a user accessed a file share they had never touched, downloaded a moderate volume, and then revoked their own MFA device. Which combination most increases concern?

  1. The novel share access combined with self-revocation of MFA, which can indicate anti-forensic preparation Correct answer.
  2. The moderate download volume alone
  3. The user's normal working hours
  4. The file share's storage capacity

Explanation

Novel access to a share followed by self-revocation of MFA suggests an actor preparing to evade future detection or lock out the legitimate user. Download volume alone, normal hours, and storage capacity do not capture that adversarial intent.