AI Bot
Behavioral Analytics & Baseline Metrics Flashcards
CompTIA CySA+ CS0-004 (V4) Flashcards
Study our Behavioral Analytics & Baseline Metrics flashcards for the CompTIA CySA+ CS0-004 (V4) exam with 40+ flashcards. View as flashcards, a searchable table, or as a fun matching game.
| Front | Back |
| Difference between point anomaly and contextual anomaly | Point anomaly is an isolated outlier while contextual anomaly depends on context such as time or location |
| Explain moving average baseline | Baseline computed as average of the most recent fixed window of observations |
| Explain seasonality adjustment in baselining | Removing or modeling repeating patterns to prevent seasonal spikes from being flagged as anomalies |
| Explain z score for anomaly detection | Z score measures how many standard deviations a value is from the mean used to flag outliers |
| Give an example of a behavioral feature for UEBA | Average login time or number of distinct devices used by a user |
| How can PCA help in anomaly detection | PCA reduces dimensionality and highlights directions of unusual variance |
| How to interpret a high false positive rate | Model or baseline may be too sensitive features may be noisy or thresholds misconfigured |
| How to measure operational impact of alerts | Track time to triage incident outcomes and analyst workload metrics |
| How to reduce alert fatigue | Tune thresholds add context and priority and implement feedback loops from analysts |
| How to use ensemble methods for anomaly detection | Combine multiple detectors and aggregate their scores for more robust alerts |
| How to validate a new baseline | Backtest against historical incidents and measure detection and false positive rates |
| Name a behavioral metric for account compromise detection | Unusual geographic login or sudden increase in failed logins |
| Name a technique to reduce false positives | Context enrichment such as adding user role or device information |
| Name three types of baselines used in behavior analytics | Static baseline rolling baseline and seasonal baseline |
| Name two statistical approaches for anomaly detection | Distribution based methods and time series decomposition |
| What is a baseline confidence interval | Range around baseline estimate that indicates expected variation used to set alert thresholds |
| What is a baseline in behavioral analytics | Typical normal pattern of activity defined from historical data used to detect deviations |
| What is a hybrid detection approach | Combining statistical rules with machine learning models to leverage strengths of both |
| What is alert prioritization | Ranking alerts by risk impact and confidence to focus analyst attention |
| What is an analyst feedback loop | Using analyst feedback to label alerts and retrain or recalibrate models |
| What is anomaly detection | Process of identifying patterns that deviate significantly from expected behavior |
| What is collective anomaly | Group of data points that are anomalous together even if individual points are not |
| What is concept drift | Change in the underlying data distribution over time that can invalidate a learned baseline or model |
| What is drift detection monitoring | Continuously checking model performance and input distribution to detect when retraining is needed |
| What is EWMA | Exponentially Weighted Moving Average gives more weight to recent observations for quicker sensitivity to change |
| What is isolation forest | Tree based anomaly detection algorithm that isolates anomalies quickly by partitioning data |
| What is label leakage risk | Using features that indirectly encode the target leading to overoptimistic evaluation and poor generalization |
| What is precision in alerting | Proportion of alerts that are true positives |
| What is recall in alerting | Proportion of actual incidents that were detected by alerts |
| What is ROC AUC used for in anomaly detection | Evaluates trade off between true positive rate and false positive rate for a detector |
| What is the F1 score | Harmonic mean of precision and recall used to balance both metrics |
| What is threshold hysteresis | Using separate thresholds for raising and clearing alerts to avoid flapping |
| What is unsupervised anomaly detection | Detecting anomalies without labeled data by modeling normal behavior only |
| What is user and entity behavior analytics UEBA | Analytics that model normal behavior of users and entities to detect insider threats and compromised accounts |
| What role does clustering play in UEBA | Groups similar behavior profiles to find entities that deviate from their cluster |
| When to use supervised models for anomaly detection | When labeled examples of normal and anomalous behavior are available |
| When to use time series models for baselining | When data exhibits temporal dependencies trends or seasonality |
| Why is explainability important for behavioral alerts | Helps analysts understand why an alert fired and speeds investigation |
| Why is feature engineering critical in behavioral analytics | Good features capture meaningful behavior and improve model accuracy and interpretability |
| Why tune thresholds | To balance detection sensitivity against false positive rates and operational workload |
About the Flashcards
Flashcards for the CompTIA CySA+ exam help students review behavioral analytics concepts used to identify unusual activity, model normal behavior, and detect security-relevant deviations. The deck covers baselines, concept drift, anomaly types, statistical scoring, time series methods, and seasonality adjustment.
These cards also reinforce how detection systems are evaluated and improved, including precision, recall, F1 score, ROC AUC, threshold tuning, and false positive reduction. Students can review UEBA, clustering, isolation forest, PCA, supervised and unsupervised models, alert prioritization, analyst feedback loops, explainability, and operational alert impact.
Topics covered in this flashcard deck:
- Behavioral baselines
- Anomaly detection
- UEBA concepts
- Detection metrics
- Alert tuning
- Model drift and validation