A security analyst monitors an organization's network using UEBA tools to detect potential threats. During the analysis, the analyst notices unusual activities, such as a user from the marketing…

Question

Options

• AUpdate antivirus software, deploy an intrusion detection system, and perform regular vulnerability scans.
• BConduct security awareness training, implement multifactor authentication, and review network segmentation.
• CImplement a stricter password policy, deploy a Web Application Firewall, and establish a Security Operations Center.
• DInvestigate potential insider threats, assess unauthorized access, and analyze VPN security configurations.

• A
  7% (2)
• B
  17% (5)
• C
  10% (3)
• D
  67% (20)

Explanation

Option D directly addresses the three specific anomalies observed: insider threat investigation covers the marketing user accessing finance files, unauthorized access assessment covers the executive's unrecognized IP login, and VPN security analysis covers the surge in failed login attempts. UEBA tools are designed to surface exactly these behavioral anomalies, so the analyst's first priority should be triaging and investigating what UEBA has already flagged - not deploying new tools.

Why the distractors fail:

• A introduces antivirus and IDS - reactive/preventive controls that don't address the behavioral incidents already in progress.
• B (awareness training, MFA, segmentation) describes good long-term hygiene but are strategic/remediation steps, not immediate incident response actions.
• C (password policy, WAF, SOC) are infrastructure and governance improvements - valid eventually, but a WAF specifically protects web applications, not the file server or VPN scenarios described.

Memory tip: When a question describes specific, active anomalies already detected, the correct answer will always respond to those specific anomalies rather than deploy new tools or run training. Match the action to the observable evidence - UEBA detected behavior problems, so the answer is behavioral investigation (D), not infrastructure additions.

No community discussion yet for this question.