Detects suspicious behavior to prevent breaches?

• A. Activity Monitoring
• B. Defense-in-Depth
• C. Escalated Access
• D. Layered Security in IAM

Answer: (A)

Monitoring user activity to identify anomalies is about watching how people interact with systems, collecting events, and analyzing behavior to spot suspicious actions that could signal a breach. Activity Monitoring uses logs from authentication, access attempts, API calls, and data transfers, and compares current activity against normal patterns or risk rules. When something unusual appears—such as logins from a new location, odd login times, a rapid series of failed attempts, or unusual data access—it raises alerts and can trigger automated responses like blocking the session or requiring re-authentication. This real-time detection and response capability is what helps prevent breaches by stopping threats before they escalate.

Defense-in-Depth describes a broad security strategy of layering controls rather than a specific detection capability. Escalated Access concerns how privileges are increased for users, not how anomalous activity is detected. Layered Security in IAM is also about multiple controls working together, but it doesn’t pinpoint the detection and immediate response aspect as directly as activity monitoring does.