Which risk factors contribute to the user behavior risk score? (Choose two.)

Question

Options

• Aoperating system
• Bgeolocation
• Cdevice certificate
• Dsession cookie
• EAD joined status of device

• B
  88% (14)
• C
  6% (1)
• E
  6% (1)

Explanation

Geolocation (B) is a behavioral risk factor because it reflects where a user is accessing resources from - anomalies like impossible travel (logging in from New York and London within minutes) or access from high-risk regions directly signal suspicious user behavior patterns used in UEBA-style risk scoring.

Note: The question says "choose two," but only B is listed as the correct answer - this may be an incomplete answer key. If a second answer is expected on your exam, context around the specific platform (e.g., Cisco, Palo Alto, Microsoft) would narrow it down.

Why the distractors are wrong:

• A (Operating system) - an OS type is a static device attribute used in device posture/compliance checks, not behavioral analysis.
• C (Device certificate) - a certificate is an authentication credential, not a behavioral signal; it validates what device is connecting, not how the user behaves.
• D (Session cookie) - session cookies manage authentication state but don't contribute to behavioral risk profiling.
• E (AD joined status) - whether a device is domain-joined is a device trust/posture attribute, not a user behavior indicator.

Memory tip: Think "behavior = patterns in time and space." Geolocation captures the where, and behavioral risk scores track dynamic, changing signals - not static credentials or device properties. If a factor stays the same regardless of what the user does, it's probably a posture/auth factor, not a behavioral one.

No community discussion yet for this question.