2.12 Apply AI-driven Threat Intelligence Using Tools 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is evaluating two AI-driven threat intelligence platforms. Platform A uses supervised machine learning trained on a large dataset of known malware, while Platform B uses unsupervised learning to detect anomalies in network traffic. The team needs to identify previously unknown malware variants that do not match any known signatures. Which platform should they choose?

   • ANeither platform can detect unknown malware variants.
   • BPlatform B, because unsupervised learning can detect anomalies that do not match known patterns.
   • CUse both platforms in parallel and combine their outputs.
   • DPlatform A, because supervised learning is more accurate for known threats.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has an AI-driven threat intelligence platform that produces a high volume of alerts. The SOC is overwhelmed and misses critical alerts. The team wants to implement a triage system that uses AI to prioritize alerts based on the organization's risk tolerance. What is the best approach?

   • AHave the SOC manually review all alerts and decide which are critical.
   • BSet the AI platform to only generate alerts for indicators with a confidence score above 90%.
   • CImplement a machine learning model that ranks alerts based on the organization's asset criticality and threat context.
   • DIncrease the number of SOC analysts to handle the alert volume.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security manager is evaluating an AI-driven threat intelligence platform that provides daily reports on emerging threats. The manager notices that the platform's reports often include threats that are not relevant to the organization's industry or technology stack. What is the most important factor to consider when assessing the platform's effectiveness?

   • AThe platform's cost compared to other threat intelligence solutions.
   • BThe platform's ability to filter and prioritize threats based on the organization's specific environment and risk tolerance.
   • CThe platform's user interface and ease of navigation.
   • DThe number of threat feeds the platform integrates, regardless of their relevance.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a common way to integrate AI-driven threat intelligence into security operations?

   • AAutomatically enriching security alerts with relevant threat context
   • BReplacing the SIEM with a standalone AI tool
   • CDisabling all automated responses to avoid false positives
   • DStoring intelligence in a separate silo for manual review
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A company wants to integrate AI-driven threat intelligence into its security operations. The company has a mature SIEM deployment and a well-defined incident response process. They want to automate the enrichment of alerts with threat intelligence and automatically block malicious indicators at the firewall. However, they are concerned about the risk of blocking legitimate traffic due to false positives. What is the best approach to mitigate this risk?

   • AUse the AI platform to enrich alerts and provide recommendations, but require human approval before blocking indicators.
   • BOnly use the AI platform for enrichment and do not integrate it with the firewall.
   • CBlock all indicators automatically but maintain a whitelist of known legitimate domains and IPs.
   • DAutomatically block all indicators flagged by the AI platform without human review.
   Reveal Solution Discussion Select an answer first