A clerk's account authenticates from City Hall at 9 a.m. and from another continent an hour later while downloading unusually large case archives. Which analytics approach best flags this pattern?

Impossible travel—authentication from City Hall and then from another continent within an hour—combined with unusually large case-archive downloads is a classic user-behavior anomaly. User behavior analytics (UBA/UEBA) baselines normal patterns for accounts and entities, then scores deviations such as geographically implausible logons, odd hours, and abnormal data-transfer volume so security teams can investigate account takeover, credential sharing, or insider exfiltration. For municipal case systems, that behavioral lens is what turns raw authentication and download logs into a prioritized alert about risk to sensitive records.

Static allow lists that never evaluate behavior over time cannot detect novel misuse of otherwise 'allowed' accounts or locations. Turning off all remote access eliminates some travel-related alerts but also breaks legitimate remote work and does not analytically flag the impossible-travel pattern when access remains enabled. Increasing MTU on a switch port is a network performance tweak with no relationship to identity anomaly detection.

Exam caveat: impossible travel can false-positive with VPNs, inaccurate geolocation, or shared accounts—tune and investigate rather than auto-destroy accounts on first score. UBA complements MFA and DLP; it does not replace strong authentication or data-loss controls.

Operational check: ensure identity and proxy/cloud logs feed the analytics platform, validate that the clerk's dual-location and volume spike generate a scored alert, and run a playbook that verifies MFA status, session revocation, and case-archive download legitimacy with the clerk's supervisor.