A company recently implemented a variety of security services to detect various types of traffic that pose a threat to the company. The following services were enabled within the network: - Scan of…

A content filter categorizes and blocks website traffic by URL or category but does not analyze user-specific behavioral patterns or detect volume anomalies in data transfers.

UBA establishes behavioral baselines for each user and generates alerts when activity deviates significantly - such as transferring large volumes of data from an on-premise server to a public site - making it the service most capable of detecting this type of data exfiltration and generating the described report. It correlates user actions over time and across sessions rather than inspecting individual packets or files in isolation, which is why it also surfaced the embedded malware and spyware as part of the broader anomaly.

An application sandbox executes suspicious files in an isolated environment to detect malware behavior, not to identify anomalous user data-sharing patterns across the network.

A web application firewall inspects HTTP/S traffic to protect web applications from injection and other exploit-based attacks, not to monitor internal user behavior or flag data exfiltration volumes.

Endpoint protection detects and blocks malware on individual devices but does not aggregate or correlate user behavior patterns across the network to identify systematic exfiltration.

A cloud access security broker monitors and enforces policy for cloud service usage, but the data source in this scenario is an on-premise server, and CASB does not perform the user-behavior baseline analysis that UBA provides.