A cloud security team is investigating a possible data exfiltration incident involving an AWS S3 bucket configured with cross-region replication. Which Cisco Cloudlock feature can detect unusual replication patterns that may indicate data theft?
UEBA detects behavioral anomalies in cloud services.
Why this answer
Cloudlock UEBA is the correct answer because it establishes behavioral baselines for user and entity activities, such as S3 bucket replication patterns. When cross-region replication deviates from the learned baseline—e.g., unusual volume, frequency, or destination—UEBA generates an anomaly alert, directly detecting potential data exfiltration. This is a core capability of Cisco Cloudlock's cloud access security broker (CASB) functionality.
Exam trap
The trap here is that candidates often confuse UEBA with network-based detection tools (like IPS or flow logs) or general threat intelligence feeds, failing to recognize that UEBA specifically addresses anomalous user and entity behavior in cloud environments like AWS S3.
How to eliminate wrong answers
Option A is wrong because Umbrella threat intelligence provides DNS-layer security and web proxy filtering, not behavioral analysis of cloud storage replication patterns. Option B is wrong because Stealthwatch Cloud flow logs analyze network traffic flows and IP behaviors, not S3 bucket replication events within AWS. Option C is wrong because Firepower IPS signatures detect known network-based attack patterns via deep packet inspection, not anomalous user or entity behavior in cloud APIs.