Which component monitors IAM anomalies across multiple identity providers?
A company needs to create a design that facilitates monitoring and alerting over the identity and access management surface. A primary design consideration should be the existence of multiple independent identity providers with a hybrid, multicloud environment. Which of the following components should be included as part of the design?
Community Insight
The question tests whether you can match identity anomaly monitoring across fragmented IdPs to the right security component; the trap is selecting CASB or SASE simply because the environment is multicloud.
User behavior analytics (UBA) is the design component that provides monitoring and alerting over the IAM surface by correlating identity events from multiple independent IdPs in hybrid multicloud environments. This page establishes why UBA, not CASB, TIP, or SASE, is the correct answer (A).
Choosing CASB because the scenario mentions cloud and multiple providers, even though CASB is built for SaaS visibility and data-policy enforcement rather than cross-IdP identity behavior alerting.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
User behavior analytics (UBA) is the component designed to ingest identity and access telemetry from multiple sources, establish baselines, and alert on anomalous authentication or authorization activity. In a hybrid multicloud estate with independent IdPs, UBA provides the cross-provider correlation that individual IdP logs cannot deliver on their own. That directly satisfies the requirement for monitoring and alerting over the IAM surface. It also supports investigation by tying anomalies to users, devices, and access patterns rather than only to network or SaaS policy events.Why the Other Options Are Wrong
CASB gives visibility and policy enforcement for SaaS usage and data movement, but it is not the primary IAM anomaly monitoring layer across independent IdPs. TIP aggregates and correlates threat intelligence feeds; it does not baseline user identity behavior or alert on IAM access anomalies. SASE bundles network and cloud security services such as ZTNA, SWG, and CASB, and while it can contribute access controls and logs, it does not replace the dedicated identity behavior analytics needed here. The question asks specifically for monitoring and alerting over the IAM surface, which points to UBA.Community Comment Notes
The learner comment from BWH9492 aligns with this reasoning, describing UBA as "alerting on identity anomalies" across fragmented IdPs and hybrid clouds. The same comment correctly separates CASB as SaaS data-policy visibility and SASE as converged network and cloud security controls. That distinction is the key to eliminating the cloud-oriented distractors. No other substantive community input changes the verdict.Exam Strategy
Map each acronym to its primary telemetry source: UBA is identity behavior analytics, CASB is SaaS data-policy visibility, TIP is threat intelligence, and SASE is converged network/cloud security. When the requirement is identity anomaly alerting across multiple independent IdPs, choose UBA rather than a cloud-access or network-convergence platform.
Frequently Asked Questions
Why is CASB not the right component for cross-IdP IAM anomaly monitoring?
CASB focuses on SaaS application visibility, data policy, and shadow IT; it does not baseline identity behavior across independent identity providers or generate IAM anomaly alerts.
Can SASE satisfy the identity monitoring requirement in this hybrid multicloud design?
SASE converges network and cloud security controls such as ZTNA and CASB, but dedicated identity anomaly detection across independent IdPs is a UBA function.