CAS-004 Security Operations Practice Question
A company uses a SIEM with User Behavior Analytics (UBA). The UBA generates an alert when a user accesses sensitive data at unusual hours. Which type of correlation rule is being applied?
⚠ Common exam trap
CAS-005 often tests the confusion between anomaly-based and threshold-based correlation, since both can involve 'unusual' activity — the key discriminator is whether a learned baseline or a fixed numeric limit drives the alert.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly-based correlation
Anomaly-based correlation establishes a baseline of normal behavior and alerts when activity deviates from that baseline. Accessing sensitive data at unusual hours is a deviation from the user's typical access pattern, which is exactly what UBA anomaly detection flags. This is distinct from threshold, signature, and trend rules, which rely on fixed counts, known patterns, or long-term statistical drift respectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Threshold-based correlation
Why it's wrong here
Threshold-based correlation fires when a count exceeds a configured limit within a window, such as many failed logins. The stem describes deviation from a user's established behaviour baseline, not a numeric count, so the trigger is behavioural analytics rather than a threshold breach.
- ✗
Signature-based correlation
Why it's wrong here
Signature-based correlation matches events against known patterns or indicators, so it cannot flag a deviation such as unusual access hours. It is the right choice when detecting known malware, exploit traffic or specific event sequences, where predefined signatures exist to match against.
- ✓
Anomaly-based correlation
Why this is correct
Anomaly-based correlation baselines normal behaviour and alerts on statistically significant deviations, rather than matching fixed signatures or thresholds. Accessing sensitive data at unusual hours deviates from the established behavioural baseline, which is precisely what this rule type detects.
- ✗
Trend-based correlation
Why it's wrong here
Trend-based correlation tracks changes in metrics over time, such as rising volumes across periods. The stem's alert reflects deviation from an individual's learned activity baseline, not a directional metric trend, so the mechanism is behavioural rather than trend analysis.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.