Which component monitors IAM anomalies across multiple identity providers?
Short answer
A Add user behavior analytics (UBA) to detect and alert on identity anomalies across multiple independent identity providers in the hybrid multicloud design.
Question
Key Takeaways
The question tests whether you can match identity anomaly monitoring across fragmented IdPs to the right security component; the trap is selecting CASB or SASE simply because the environment is multicloud.
User behavior analytics (UBA) is the design component that provides monitoring and alerting over the IAM surface by correlating identity events from multiple independent IdPs in hybrid multicloud environments. This page establishes why UBA, not CASB, TIP, or SASE, is the correct answer (A).
Common mistake: Choosing CASB because the scenario mentions cloud and multiple providers, even though CASB is built for SaaS visibility and data-policy enforcement rather than cross-IdP identity behavior alerting.
Expert Analysis
Why the Answer Is Correct
User behavior analytics (UBA) is the component designed to ingest identity and access telemetry from multiple sources, establish baselines, and alert on anomalous authentication or authorization activity. In a hybrid multicloud estate with independent IdPs, UBA provides the cross-provider correlation that individual IdP logs cannot deliver on their own. That directly satisfies the requirement for monitoring and alerting over the IAM surface. It also supports investigation by tying anomalies to users, devices, and access patterns rather than only to network or SaaS policy events.
Why the Other Options Are Wrong
CASB gives visibility and policy enforcement for SaaS usage and data movement, but it is not the primary IAM anomaly monitoring layer across independent IdPs. TIP aggregates and correlates threat intelligence feeds; it does not baseline user identity behavior or alert on IAM access anomalies. SASE bundles network and cloud security services such as ZTNA, SWG, and CASB, and while it can contribute access controls and logs, it does not replace the dedicated identity behavior analytics needed here. The question asks specifically for monitoring and alerting over the IAM surface, which points to UBA.
Community Comment Notes
The learner comment from BWH9492 aligns with this reasoning, describing UBA as "alerting on identity anomalies" across fragmented IdPs and hybrid clouds. The same comment correctly separates CASB as SaaS data-policy visibility and SASE as converged network and cloud security controls. That distinction is the key to eliminating the cloud-oriented distractors. No other substantive community input changes the verdict.
Exam Strategy
Map each acronym to its primary telemetry source: UBA is identity behavior analytics, CASB is SaaS data-policy visibility, TIP is threat intelligence, and SASE is converged network/cloud security. When the requirement is identity anomaly alerting across multiple independent IdPs, choose UBA rather than a cloud-access or network-convergence platform.
Frequently Asked Questions
Why is CASB not the right component for cross-IdP IAM anomaly monitoring?
Can SASE satisfy the identity monitoring requirement in this hybrid multicloud design?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
BWH9492 👍 1 Answered AUBA: Monitoring & alerting on identity anomalies across multiple fragmented IdPs / hybrid clouds. CASB: Enforcing data policies and visibility on cloud SaaS applications. SASE: Converging network SD-WAN and cloud security controls.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.