2.12 Apply AI-driven Threat Intelligence Using Tools 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security analyst is using an AI-driven threat detection tool that analyzes network traffic and flags anomalies. The tool has a high false-positive rate, causing the SOC to spend significant time investigating benign events. The analyst wants to reduce false positives without missing real threats. What should the analyst do?

   • AIncrease the anomaly detection threshold to reduce the number of alerts.
   • BDisable the AI tool and rely on manual analysis of all network traffic.
   • CIgnore the alerts and focus on other security tasks.
   • DProvide feedback to the AI model by marking false positives and retraining the model.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to use AI-driven threat intelligence to proactively block malicious domains before they are accessed by users. They have an AI platform that provides a feed of malicious domains. What is the best way to implement this?

   • ABlock the domains only after a user accesses them.
   • BSend the domain feed to users via email and ask them to avoid those sites.
   • CManually add the domains to the hosts file on each workstation.
   • DConfigure the DNS server to use the AI platform's domain feed as a blocklist.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which practice best supports proactive defense using AI-driven threat intelligence?

   • AWaiting for an attack to occur before analyzing intelligence
   • BKeeping intelligence reports in a PDF for auditors only
   • CIgnoring intelligence that does not match current incidents
   • DFeeding AI-generated indicators into security controls to block known threats
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A security manager is evaluating an AI-driven threat intelligence platform that provides a confidence score for each threat indicator. The platform's confidence scores are based on the number of sources that report the indicator and the reputation of those sources. The manager wants to use these scores to prioritize response actions. However, the manager notices that some indicators with high confidence scores are not relevant to the organization's environment. What is the best way to use the confidence scores?

   • AIgnore confidence scores and focus only on the relevance of the indicators.
   • BUse the confidence scores to automatically block all indicators with a high score.
   • CCombine confidence scores with relevance filters based on the organization's industry, technology stack, and threat model.
   • DUse the confidence scores as the sole factor for prioritization, since they reflect the reliability of the intelligence.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security analyst is evaluating an AI-driven threat intelligence platform that provides a risk score for each alert. The analyst notices that the platform assigns high risk scores to alerts that are often false positives. What is the best way to assess the platform's effectiveness?

   • AReview the platform's user interface to see if it displays enough information.
   • BCompare the platform's alerts to those from a different vendor to see which generates more alerts.
   • CTrust the platform's risk scores because they are generated by AI and therefore accurate.
   • DCalculate the precision and recall of the platform's alerts against a known dataset of true and false positives.
   Reveal Solution Discussion Select an answer first