2.12 Apply AI-driven Threat Intelligence Using Tools 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A security analyst is evaluating an AI-driven threat intelligence platform that uses machine learning to generate alerts. The platform's precision is 0.95 and recall is 0.60. The SOC has limited resources and wants to minimize the number of false positives. Which metric is most important to consider, and why?

   • ABoth equally, because they are both important for evaluating the platform.
   • BThe F1 score, because it balances precision and recall.
   • CRecall, because it indicates the proportion of true threats that are detected, which is critical for security.
   • DPrecision, because it indicates the proportion of alerts that are true positives, which is critical when resources are limited.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is using an AI-driven threat intelligence platform to aggregate data from multiple sources. The platform uses natural language processing (NLP) to analyze threat reports and extract indicators. What is the primary benefit of using NLP in this context?

   • AIt helps the platform generate human-readable summaries for analysts.
   • BIt enables the platform to extract structured indicators from unstructured text.
   • CIt allows the platform to predict future attacks based on historical reports.
   • DIt allows the platform to automatically translate threat reports into multiple languages.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations team wants to incorporate AI-driven threat intelligence into their incident response process. They currently use a SIEM and a ticketing system. The team wants to automatically create tickets for high-priority alerts and include relevant threat context. Which integration should they implement?

   • ASet up email notifications from the AI platform to the security team's mailbox and let them manually create tickets.
   • BUse the AI platform to replace the SIEM and ticketing system entirely.
   • CHave analysts manually copy alert details from the AI platform into the ticketing system.
   • DConfigure the AI threat intelligence platform to send alerts directly to the SIEM, and then have the SIEM create tickets in the ticketing system via API.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is using an AI-driven threat intelligence platform that provides a daily report of high-risk indicators. The team notices that many indicators are false positives, and the report is not aligned with their organization's threat model. The team wants to improve the relevance of the intelligence. What should they do?

   • AIncrease the frequency of the report to multiple times per day.
   • BAsk the platform vendor to provide more indicators.
   • CAdjust the platform's configuration to focus on the organization's industry and geographic region.
   • DIgnore the report and rely on other sources.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key capability of an AI-powered threat intelligence platform?

   • AGenerating raw network traffic logs for forensic analysis
   • BAutomatically correlating indicators from multiple sources to identify related threats
   • CReplacing all security controls in the organization
   • DProviding a manual repository for analysts to upload indicators
   Reveal Solution Discussion Select an answer first