SY0-701 Question 341
Single answerUser behavior analyticsA security analyst is tuning a newly deployed user behavior analytics (UBA) capability in the company SIEM. Over the last week, the analyst noticed an alert on a finance employee who normally logs in from the New York office between 8:00 a.m. and 5:00 p.m. On Tuesday, the employee authenticated successfully from New York at 9:00 a.m., then accessed several payroll files, and 20 minutes later the same account initiated a VPN session from another country and downloaded a large volume of data from a file share it had never accessed before. The employee confirms they were in New York all day and did not use the VPN. Which of the following is the BEST reason this activity was flagged by UBA?
- A
The account's activity deviated from its established baseline, indicating anomalous behavior consistent with possible credential compromise
- B
The SIEM detected a known malware signature on the payroll files that automatically triggered a UBA alert
- C
UBA blocks all logins from foreign countries by default when an employee has already logged in locally that day
- D
The VPN connection failed multifactor authentication, which proves the employee's account was not compromised
Show answer and explanation
Correct answer: A
Explanation
User behavior analytics works by establishing a baseline of normal behavior for users and entities, then identifying anomalies that may indicate misuse, insider threat, or account compromise. In this scenario, several high-risk indicators align with common UBA use cases: access from a new geolocation, impossible travel timing, unusual resource access, and abnormal download volume. These are all classic signs that the employee's account may have been compromised. This reflects common Security+ expectations around behavioral analysis, anomaly detection, and correlation in SIEM/UEBA platforms. Best practices from major security guidance, including NIST-aligned monitoring principles, support using baselines, contextual analysis, and alert triage to investigate potentially compromised accounts rather than relying solely on signature-based tools.
- A. Correct.
Correct. UBA identifies deviations from normal user patterns, such as unusual geolocation, impossible travel, abnormal access to new resources, and atypical data download volume. In this scenario, the account's behavior differs significantly from the employee's established baseline, which is exactly the kind of anomaly UBA is designed to surface for investigation.
- B. Incorrect.
Incorrect. Malware signature detection is typically associated with antivirus, EDR, IDS/IPS, or content inspection tools rather than UBA itself. UBA focuses on behavioral patterns and anomalies in user activity, not signature-based detection of malicious files.
- C. Incorrect.
Incorrect. UBA does not inherently block all foreign logins by default. It is primarily an analytics and alerting capability that detects suspicious deviations from normal behavior. Blocking may occur only if separate conditional access, identity protection, or automated response policies are configured.
- D. Incorrect.
Incorrect. The scenario states the account initiated a VPN session, which suggests the login was successful or at least sufficiently established to generate activity. Even if MFA had failed, that alone would not explain the subsequent abnormal file access and downloads. Also, failed MFA would not prove the account was safe; attackers may still possess valid credentials or be testing access.