Which two elements does Prisma Cloud monitor when analyzing for unusual user activity? (Choose two.)

Question

Options

• AOperating System (OS)
• Bbrowser
• Clocation
• Dtime

• A
  6% (3)
• B
  4% (2)
• C
  89% (42)

Explanation

Prisma Cloud's unusual user activity detection focuses on location and time because these two behavioral signals are the most reliable indicators of account compromise - a login from an unexpected country or at 3 AM outside a user's normal pattern strongly suggests unauthorized access. These factors feed into Prisma Cloud's UEBA (User and Entity Behavior Analytics) engine, which baselines normal behavior and alerts when deviations occur across either dimension.

Operating System (A) and browser (B) are not the behavioral baselines Prisma Cloud uses for this specific anomaly detection feature - while they can appear in audit logs, they are not the two monitored elements for unusual user activity analysis in the Prisma Cloud context.

Memory tip: Think of "Where and When" - Prisma Cloud asks where (location) and when (time) to catch suspicious access. A hacker logging in from Russia at midnight when the user normally works in Chicago at 9 AM triggers both signals at once.

No community discussion yet for this question.