Term captures the practice of continuously monitoring user activity to detect suspicious behavior?

• A. Defense-in-Depth
• B. Activity Monitoring
• C. Escalated Access
• D. Administrator Access

Answer: (B)

Continuously watching user actions to detect suspicious behavior is activity monitoring. This practice involves collecting and analyzing logs, authentication events, file accesses, and usage patterns to spot unusual or unauthorized activities and trigger alerts or responses. It’s commonly implemented with tools like SIEM (security information and event management) and UEBA (user and entity behavior analytics) to identify anomalies in real time. This concept differs from defense-in-depth, which focuses on multiple layers of security controls; escalated access, which means granting higher privileges for a task; and administrator access, which is simply a type of privileged account. Therefore, the term that best fits the description is activity monitoring.