Microsoft Security, Compliance, and Identity Fundamentals (SC-900)Describe the concepts of security, compliance, and identityMedium
A compliance officer is setting up a new system to monitor user activities within cloud applications. The goal is to detect unusual login patterns, such as multiple failed login attempts from different geographic locations in a short period, or access to sensitive resources by a user who rarely interacts with them. Which security capability is best suited for this type of monitoring and anomaly detection?
- AThreat Protection
- BConditional Access
- CSecurity Information and Event Management (SIEM)
- DUser and Entity Behavior Analytics (UEBA)
Show answer & explanationAnswer & explanation
Correct answer: D. User and Entity Behavior Analytics (UEBA)
User and Entity Behavior Analytics (UEBA) specializes in establishing baselines of normal user behavior and then identifying statistical anomalies that could indicate compromised accounts, insider threats, or other malicious activities.
Why the other options are wrong
- A. Threat Protection is a broad category; UEBA is a specific type of threat protection for behavioral anomalies.
- B. Conditional Access enforces policies *before* access is granted but doesn't monitor for anomalous behavior *after* authentication.
- C. SIEM collects and aggregates logs, which UEBA can leverage, but SIEM itself doesn't inherently perform behavioral anomaly detection without additional analytics capabilities often provided by UEBA.
User and Entity Behavior Analytics (UEBA)
UEBA is a cybersecurity process that leverages machine learning and deep learning algorithms to analyze user and entity behavior patterns, identify deviations from normal baselines, and detect potential threats or attacks.
- Establishes baselines of normal behavior.
- Detects anomalies indicative of threats.
- Identifies insider threats and compromised accounts.
Memory trick: UEBA watches for the odd ones out in behavior patterns.