ISC2 Certified Cloud Security Professional (CCSP) Practice Question

UEBA components in modern SIEM or XDR platforms apply machine-learning algorithms to establish normal behavioral baselines for each user, host, and application. When future activity significantly deviates from these learned patterns-such as a normally idle development VM suddenly launching large outbound transfers in the middle of the night-the anomaly-based engine flags the event for investigation. Signature matching relies on known indicators and would only trigger if the destination matched an existing rule. Log rotation or RBAC evaluation do not assess traffic patterns or behavioral context, so they would not identify this type of unusual but previously unseen activity. Therefore, behavior-based anomaly detection (baseline deviation) is the function that generated the alert.