Behavioral Indicators combine other indicators to form a profile.

• A. Combine other indicators to form a profile
• B. They are standalone data points that indicate activity
• C. The most common among computed indicators
• D. They represent hardware anomalies

Answer: (A)

Behavioral indicators are built by combining multiple signals to create a profile of typical user or system activity. Instead of judging a single event, they stitch together context over time—things like logon times, source and destination IPs, device used, accessed resources, and data transfer volumes—to establish a baseline. When current activity deviates from that profile, the behavioral indicator flags a potential issue. This is why the correct option says they combine other indicators to form a profile: they’re about aggregating signals to describe normal and abnormal behavior, not about isolated data points, hardware quirks, or being the most common type of computed indicator. For example, a behavioral indicator might trigger when a user logs in from a new country, on an unusual device, after hours, and accesses a high-volume set of sensitive files—a pattern that a single data point wouldn’t reveal.