ISC2 CISSP Practice Question

The correct answer is User and Entity Behavior Analytics (UEBA). UEBA solutions are specifically designed to address this type of threat by first establishing a baseline of normal behavior for users and entities (e.g., servers, devices) within a network. Using machine learning and advanced analytics, UEBA systems then monitor for deviations from this baseline, such as unusual login times, abnormal data access patterns, or large data transfers. This makes UEBA particularly effective at detecting insider threats and compromised accounts, which might not be caught by signature-based tools like an Intrusion Prevention System (IPS). While a Security Information and Event Management (SIEM) system aggregates logs and can use correlation rules, it is the UEBA functionality that excels at this specific type of dynamic, behavioral anomaly detection. A Web Application Firewall (WAF) focuses on protecting web applications from attacks like SQL injection, not on user behavior baselining.