hardMultiple ChoiceObjective-mapped
CRISC Practice Question: A security operations center (SOC) analyst…
A security operations center (SOC) analyst notices multiple failed login attempts from an internal IP address followed by a successful login from an unusual geographic location. Which risk identification technique should the risk manager use to assess this as a potential risk?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform user and entity behavior analytics (UEBA) on the user account
User and entity behavior analytics (UEBA) uses behavioral baselines and anomaly detection to identify patterns such as multiple failed logins followed by a successful login from an unusual geographic location, which is indicative of account compromise and a potential risk. Option A is incorrect because a phishing simulation tests user susceptibility to phishing attacks, not behavioral anomalies in login patterns. Option B is incorrect because manual log review is time-consuming and may not effectively detect subtle behavioral deviations without automated analysis. Option C is incorrect because a vulnerability scan focuses on system vulnerabilities, not user behavior.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run a phishing simulation for the user
Why it's wrong here
Simulation tests awareness, not current event.
- ✗
Review the logs manually for other indicators
Why it's wrong here
Manual review may miss context; analytics is more effective.
- ✗
Conduct a vulnerability scan on the workstation
Why it's wrong here
Vulnerability scan does not address behavioral anomalies.
- ✓
Perform user and entity behavior analytics (UEBA) on the user account
Why this is correct
UEBA detects deviations from normal behavior, signaling potential compromise.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.