2.12 Apply AI-driven Threat Intelligence Using Tools 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A mid-sized company wants to implement an AI-driven threat intelligence platform to improve its security posture. The company has a small security team and limited budget. They need a solution that can aggregate threat data from multiple sources, provide automated correlation, and integrate with their existing SIEM. Which type of solution should they choose?

   • AA manual threat intelligence process using spreadsheets and email alerts from free threat feeds.
   • BAn on-premises threat intelligence platform that requires dedicated hardware and a full-time administrator to manage.
   • CA custom-built threat intelligence system developed in-house using open-source tools.
   • DA cloud-based AI-driven threat intelligence platform with built-in integrations to common SIEMs and a user-friendly dashboard.
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   A large enterprise is considering two AI-driven threat intelligence platforms. Platform X uses supervised learning and requires labeled data from the organization to train its models. Platform Y uses unsupervised learning and does not require labeled data. The organization has a mature security team but limited labeled data. They want to quickly deploy a platform that can detect unknown threats. Which platform should they choose?

   • APlatform Y, because unsupervised learning can detect unknown threats without requiring labeled data.
   • BPlatform Y, because it is always more effective than supervised learning.
   • CPlatform X, because it can be trained using external threat intelligence feeds.
   • DPlatform X, because supervised learning is more accurate than unsupervised learning.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst at a mid-sized company is reviewing alerts from the AI-driven threat intelligence platform. The platform flags a domain as malicious because it was observed in a phishing campaign last month. However, the domain is currently used by the company's marketing team for a legitimate email campaign. The analyst must decide whether to block the domain. What should the analyst do first?

   • ACheck the AI platform's confidence score and supporting evidence for the domain.
   • BBlock the domain immediately because the AI platform flagged it.
   • CAsk the marketing team to stop using the domain immediately.
   • DIgnore the alert because the domain is used by the marketing team.
   Reveal Solution Discussion Select an answer first
5. 34expert · medium

   A security team is evaluating two AI-driven threat intelligence platforms. Platform A has a high detection rate but generates many false positives, overwhelming the SOC. Platform B has a lower detection rate but produces very few false positives, allowing the team to focus on high-confidence alerts. The team has limited staffing and cannot handle a high volume of alerts. Which platform should they choose, and why?

   • APlatform B, because it is likely cheaper than Platform A.
   • BPlatform B, because the lower false positive rate allows the team to focus on high-confidence alerts and reduces alert fatigue.
   • CPlatform A, because a high detection rate is more important than the number of false positives.
   • DPlatform A, because it can be tuned to reduce false positives over time.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company is deploying an AI-driven threat intelligence platform to aggregate data from multiple sources, including open-source feeds, commercial feeds, and internal telemetry. The platform uses machine learning to correlate indicators and provide a unified view. The security team wants to ensure the platform's outputs are actionable for their SOC. What is the most important capability to verify?

   • AThe platform can ingest data in various formats and normalize it into a common schema.
   • BThe platform has a dashboard that displays the number of indicators processed.
   • CThe platform supports exporting indicators in STIX/TAXII format.
   • DThe platform provides confidence scores and context for each correlated indicator.
   Reveal Solution Discussion Select an answer first