Certified Incident Handler (CIH) Practice Ecam

Which solution helps incident handlers monitor employees for unusual behavior?

1. User and Entity Behavior Analytics (UEBA)

2. Human Resource Management Systems (HRMS)

3. Cloud-based storage solutions

4. Network Access Control (NAC)

The correct answer is: User and Entity Behavior Analytics (UEBA)

User and Entity Behavior Analytics (UEBA) is specifically designed to monitor and analyze the behavior of users and entities within an organization's network. UEBA leverages advanced analytics, machine learning, and algorithms to establish a baseline of normal behavior for users and entities. By continuously monitoring activities, UEBA can detect deviations from this baseline, which may indicate unusual or suspicious behavior possibly linked to malicious activities. For instance, if an employee suddenly accesses sensitive data during odd hours or tries to access areas of the network they typically do not utilize, UEBA can flag these activities for further investigation. This capability is essential for incident handlers as it helps in identifying potential insider threats or account compromises that traditional security monitoring might miss. While other options like Human Resource Management Systems (HRMS) facilitate employee records and management, or Cloud-based storage solutions which manage data and its access, they do not focus on behavioral analysis for security purposes. Network Access Control (NAC) is primarily concerned with managing devices on a network and enforcing policies for network access rather than monitoring employee behavior directly. Thus, the focus of UEBA on user behavior analysis makes it the suitable solution for monitoring employees for unusual behavior.