As part of an ongoing incident investigation, you want to examine all data/events that are relevant to updating user profiles. Which dataset from the UBA portal should you use?

Question

Options

• ABehavior
• BConfiguration
• CApplication
• DAccess Control

• A
  5% (1)
• B
  81% (17)
• C
  10% (2)
• D
  5% (1)

Explanation

Configuration data in the UBA portal captures changes made to accounts and system settings, including profile update events - making it the right dataset for tracking who modified user profiles, when, and what changed during an incident.

Why the distractors are wrong:

• A. Behavior focuses on user activity patterns and anomaly detection (e.g., unusual login times or data access), not on account modification events.
• C. Application covers application-level activity logs - how users interact with apps - not changes to account or profile settings.
• D. Access Control deals with authentication and authorization events (logins, permission grants/denials), not profile attribute changes.

Memory tip: Think of "Configuration" as anything that changes how something is set up - a profile update reconfigures a user account, so it lives in Configuration data. If it were about who accessed what, you'd look at Access Control; if it were about how someone behaved, you'd look at Behavior.

No community discussion yet for this question.