VECTRA-NDR Practice Test

VECTRA-NDR practice test: what's covered

• Network/Identity/Cloud Detection & Response
• Attack Signal Intelligence

Free VECTRA-NDR sample questions

1. Network Detection and Response (NDR) is BEST described as:

   • A. An endpoint antivirus
   • B. A capability that monitors network traffic (and increasingly identity/cloud activity) to DETECT attacker behaviors — reconnaissance, lateral movement, C2, exfiltration — and enable response, including in encrypted traffic via metadata
   • C. A firewall ruleset
   • D. A backup tool
   Show answer

   Correct: B. NDR watches the network for attacker behavior (recon, lateral movement, C2, exfil) — crucially seeing things EDR can't (unmanaged devices, east-west movement) and working on encrypted traffic via metadata. Vectra is AI-driven NDR extended to identity/cloud.

2. A core value of NDR that EDR alone does NOT provide is:

   • A. Nothing — they are identical
   • B. Visibility into devices/traffic with NO endpoint agent (IoT, OT, BYOD, unmanaged servers) and east-west lateral movement between hosts — the network sees what endpoints can't
   • C. Faster BGP
   • D. Password rotation
   Show answer

   Correct: B. EDR only sees agented endpoints. NDR sees ALL network participants (IoT/OT/BYOD/unmanaged) and lateral movement between them. Together (with identity/cloud) they give XDR coverage. NDR fills EDR's blind spots.

3. The Vectra AI platform extends NDR to cover which domains?

   • A. Network only
   • B. Network, Identity, and Cloud (e.g., Microsoft Entra ID / M365, AWS) — correlating attacker signal across all three for hybrid/multi-cloud coverage
   • C. Only endpoints
   • D. Only email
   Show answer

   Correct: B. Vectra spans network + identity + cloud (Entra ID/M365, AWS, etc.), correlating signal across domains. Modern attacks cross these boundaries (network foothold → identity abuse → cloud exfil), so unified coverage is the point.

4. Which TWO attacker behaviors is NDR especially well-suited to detect? (Choose 2)

   • A. Lateral movement between internal hosts (east-west)
   • B. Command-and-control (C2) beaconing and data exfiltration
   • C. A user mistyping a password once
   • D. A BGP route change
   Show answer

   Correct: A and B. NDR excels at network-visible attacker behavior: lateral movement, recon, C2 beaconing, and exfiltration. These traverse the network where NDR watches. A single password typo isn't an attack; BGP changes aren't attacker behavior per se.

5. Vectra's detection philosophy emphasizes:

   • A. Matching known signatures only
   • B. Detecting attacker BEHAVIORS/methods with AI (regardless of specific malware/tool) — so novel and unknown threats are caught by what they DO, not just by known indicators
   • C. Relying solely on IOCs
   • D. BGP analysis
   Show answer

   Correct: B. Vectra focuses on behavior/methods (Attack Signal Intelligence) — modeling how attackers operate, so it catches novel tools/zero-days exhibiting malicious behavior. Signature/IOC-only approaches miss the new; behavior-based detection generalizes.

Last updated: 2026-10-19

VECTRA-NDR practice test FAQ