3.4 Interpret the Sequence of Events During an Attack Based on Predictive AI Analysis of Traffic Patterns 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A predictive AI model is designed to detect DNS tunneling. It flags a client that is making a high volume of DNS queries to a single domain, with each query containing a long random subdomain. The AI also notes that the client is sending data to a known malicious IP via DNS responses. Which interpretation of this sequence is most accurate?

   • AThe client is performing legitimate dynamic DNS updates.
   • BThe client is under a DNS amplification attack.
   • CThe client is experiencing a DNS misconfiguration causing excessive recursive queries.
   • DThe client is using DNS as a covert C2 channel to exfiltrate data and receive commands.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When interpreting an attack sequence from predictive AI outputs, what does the chronological order of events primarily reveal?

   • AThe progression of the attacker's actions from initial access toward the objective
   • BThe total cost of the incident
   • CThe list of all vulnerabilities in the network
   • DThe exact identity of the attacker
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A predictive AI model is trained on network flow data to detect early signs of ransomware. It flags a workstation that suddenly starts encrypting files on a network share and simultaneously communicates with an IP that has a low reputation. The AI also notes that the workstation's user typically logs in at 9 AM, but the activity occurs at 3 AM. Which combination of factors most strongly indicates a malicious attack sequence rather than a false positive?

   • ABulk encryption of shared files and communication with a low-reputation IP, but the user logged in at a normal time
   • BUnusual login time and bulk encryption, but the IP is a known content delivery network
   • CUnusual login time, bulk encryption of shared files, and communication with a low-reputation IP
   • DUnusual login time and communication with a low-reputation IP, but the file encryption is limited to a few personal files
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which attack stage is most directly associated with an AI alert that flags unusual outbound traffic to a known command-and-control server?

   • ACommand and control
   • BExfiltration
   • CReconnaissance
   • DLateral movement
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary basis for predictive AI to distinguish normal traffic from malicious patterns?

   • ABlocking all traffic that uses uncommon ports
   • BRequiring every user to authenticate before any traffic is allowed
   • CLearning from historical traffic data to identify deviations from established baselines
   • DRandomly sampling traffic to decide if it looks suspicious
   Reveal Solution Discussion Select an answer first