2.12 Apply AI-driven Threat Intelligence Using Tools 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which statement best describes how AI enhances the dissemination of threat intelligence?

   • AIt automatically blocks all malicious indicators without requiring human approval
   • BIt stores all intelligence in a single centralized repository for manual review
   • CIt ensures that all threat intelligence is shared publicly with the entire security community
   • DIt delivers tailored, actionable intelligence to the right stakeholders at the right time
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst is reviewing an AI-generated alert that flags a user account for downloading a suspicious file. The AI model assigned a high risk score because the file hash matches a known malware signature and the user's behavior deviates from their baseline. The analyst notices that the file is a signed installer from a reputable vendor. What should the analyst do?

   • AOverride the alert as a false positive and document the reasoning, then adjust the model's feature weights to reduce similar false positives.
   • BInvestigate the alert further by checking the file's reputation, the vendor's legitimacy, and the user's intent before deciding whether to escalate.
   • CImmediately block the file across the organization and reset the user's password.
   • DTreat the alert as a true positive because the AI model is more reliable than human judgment.
   Reveal Solution Discussion Select an answer first
4. 38expert · medium

   A security analyst is using an AI-driven threat intelligence platform that uses a combination of supervised and unsupervised learning to detect threats. The platform generates an alert for a user account that is exhibiting behavior consistent with a known attack pattern. The analyst investigates and finds that the user is a new employee who is performing their job duties. What should the analyst do?

   • AImmediately disable the user's account to prevent potential damage.
   • BInvestigate further to determine if the behavior is consistent with the user's job role and whether any other indicators of compromise are present.
   • CMark the alert as a false positive and provide feedback to the platform to improve its model.
   • DTreat the alert as a true positive because the behavior matches a known attack pattern.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An analyst is using an AI-driven tool to analyze network traffic and detect command-and-control (C2) communication. The tool flags a connection to an IP address that is not on any threat list but has a high entropy domain name. What should the analyst do?

   • ATreat the connection as suspicious and investigate further.
   • BIgnore the connection because the IP is not on a threat list.
   • CBlock the IP address immediately.
   • DAdd the domain to the threat list and move on.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company uses an AI-driven threat intelligence platform that generates indicators of compromise (IOCs) from global threat feeds. The security team wants to automatically block these IOCs on their firewall. What is the best approach?

   • AHave the firewall pull IOCs from the platform's web portal daily.
   • BAsk the platform vendor to email the IOCs to the security team.
   • CUse the platform's API to push IOCs to the firewall automatically.
   • DManually add each IOC to the firewall block list.
   Reveal Solution Discussion Select an answer first