Behavioral threat analytics Security School

1. The fundamental problem real-time BTA solves is:
 

• Providing forensic analysis of prior attacks
• Predicting future threats
• Providing actionable insight into immediate threats
• Uncovering vulnerabilities that might be exploited by attackers in future

2. Real-time BTA accomplishes this by:

• Logging and tracking all events in an environment
• Detecting anomalous behavior of users and systems
• Thwarting known attacks
• Creating a GUI for reporting security events

3. The fundamental mechanism behind real-time BTA is:

• Machine learning
• Logging and monitoring
• Checkpoint inhibiting
• Remote sensing

4. Real-time BTA replaces which category of security technologies?
 

• SIEM
• Next-Generation Firewall (NGFW)
• IDS/IPS
• None; it adds a new layer of analytics

5. Which of the following does not describe real-time BTA?
 

• Relies on machine learning
• Correlates disparate streams of data
• Integrates with existing tools
• Replaces existing logging and monitoring tools

6. Which of the following is not a benefit of real-time BTA?
 

• Provides economic quantification of infosec risks
• Reduces the number of false positive event notifications
• Automates detection of malicious behavior by users and systems
• Documents and tracks an attack for compliance purposes

7. Which of the following do most real-time BTA solutions monitor?
 

• User behavior
• Network element behavior
• Device behavior
• All of the above

8. Where are most real-time BTA solutions deployed?
 

• In the cloud
• On premises
• Both
• It depends

9. Which of the following is not a significant differentiator among BTA systems?
 

• Type and degree of machine learning
• Time to value (TTV) from setup to anomaly discovery
• Use of behavioral analysis to uncover threats
• Presence or absence of remote agent

10. Which of the following are good reasons not to deploy BTA? (Check all that apply)

 

• Your existing environment lacks mature tools and processes
• Your organization doesn’t care about information security
• You already have SIEM and/or IDS/IPS in place
• Your organization is small, homogeneous, and unlikely to grow