2.12 Apply AI-driven Threat Intelligence Using Tools 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security operations center (SOC) receives thousands of raw alerts daily from multiple sources. The team wants to reduce alert fatigue by automatically grouping related alerts into incidents and prioritizing them based on the likelihood of compromise. The solution must also enrich alerts with external threat context to help analysts quickly understand the threat. Which approach best meets these requirements?

   • AImplement a firewall rule to block all traffic from IP addresses listed in a static threat feed.
   • BDeploy an AI-driven threat intelligence platform that correlates alerts with global threat feeds and uses ML models to score and group related alerts into incidents.
   • CUse a sandbox to detonate every file that triggers an alert and then manually review the sandbox reports.
   • DConfigure a SIEM to forward all raw alerts to a ticketing system and let analysts manually triage each alert.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team is considering using an AI-driven threat intelligence platform to improve their threat detection. They want to understand how AI can enhance the collection and analysis of threat data. What is a key benefit of using AI in threat intelligence?

   • AAI can guarantee that all threats are detected.
   • BAI can automatically generate new malware signatures.
   • CAI can replace the need for human analysts entirely.
   • DAI can process large volumes of data and identify patterns that are not obvious to humans.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is using an AI-driven threat intelligence platform to detect malicious activity in network traffic. The platform uses unsupervised learning to identify anomalies. The analyst receives an alert about unusual outbound traffic from a server that normally has low traffic. The analyst investigates and finds that the server is performing a legitimate large data transfer. What should the analyst do?

   • ABlock the server's outbound traffic to prevent potential data exfiltration.
   • BEscalate the alert to a senior analyst for further investigation.
   • CMark the alert as a false positive and provide feedback to the platform to improve its model.
   • DIgnore the alert and take no further action.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is using an AI-driven threat intelligence platform that provides a risk score for each alert. The team notices that the risk scores are consistently high for alerts that turn out to be false positives. They want to calibrate the model to improve accuracy. What should they do?

   • AAdjust the risk score threshold to be higher.
   • BIgnore the risk scores and rely on manual analysis.
   • CProvide feedback to the platform by marking false positives and retraining the model.
   • DAsk the vendor to disable the risk scoring feature.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is using an AI-driven tool that analyzes endpoint behavior to detect ransomware. The tool flags a process that is encrypting files and contacting a known command-and-control server. What should the analyst do?

   • AWait for the AI tool to provide more evidence before acting.
   • BIsolate the endpoint and terminate the process.
   • CDisable the AI tool and investigate manually.
   • DIgnore the alert because the AI tool has a high false-positive rate.
   Reveal Solution Discussion Select an answer first