Cisco Duo administrators want to be told when a user authenticates in an unusual way, for example from a new country and a never-seen device shortly after a normal login elsewhere, so they can review it. Which Duo capability is designed for this?
Select an answer to reveal the explanation.
Short Explanation
Trust Monitor is the friend who says "wait, weren't you just in Chicago?" It learns each user's normal patterns and puts the weird logins in front of you. Health checks look at the device, not at whether the login story makes sense.
Full Explanation
Duo Trust Monitor analyzes authentication data to model typical behavior for users and their access patterns, such as usual locations, devices, applications and times. When an authentication deviates in a way that suggests risk, for example impossible travel, an unfamiliar device combined with a new location, or a pattern consistent with push harassment, Trust Monitor surfaces it as a security event that administrators can review, mark as expected or investigate further. Duo SSO provides a single sign-on identity provider in front of applications; it simplifies login but is not the component that detects anomalous behavior. The Duo Device Health application reports endpoint posture, such as operating system version, firewall and encryption status, which is a device hygiene check rather than an analysis of whether an authentication is unusual. Self-service portals allow users to add or manage their authentication devices and do not alert administrators about suspicious sign-ins. Exam caveat: Trust Monitor surfaces risk for human review; preventive decisions at login come from policies such as Adaptive Access. Operational check: review recent Trust Monitor events, confirm the anomalous login appears with its contributing factors, and verify how the administrator triaged it.