What technique is used to identify anomalous user behavior in cyber audits?

• A. Rely on yearly audits
• B. Monitor only privileged accounts
• C. Use UEBA and baseline analytics
• D. Use random sampling of users

Answer: (C)

Identifying anomalous user behavior relies on understanding what normal activity looks like and spotting deviations from that baseline. Using UEBA, or User and Entity Behavior Analytics, together with baseline analytics, does exactly this. UEBA builds a baseline of typical actions for users, devices, and applications, then applies analytics or machine learning to flag unusual patterns—such as odd login times or locations, unusual data access volumes, or rare sequences of actions. This approach can reveal compromised accounts or insider misuse that fixed-rule checks might miss, because it considers the broader context of how things usually operate rather than checking against a static rule set.

Yearly audits don’t provide continuous monitoring and can miss incidents that occur between audits. Monitoring only privileged accounts ignores anomalies in the broader environment that can evolve into bigger threats. Random sampling of users risks missing rare but significant behaviors. In contrast, UEBA with baseline analytics offers ongoing, data-driven detection across the entire user population, making it the best fit for identifying anomalous behavior in cyber audits.