3.4 Interpret the Sequence of Events During an Attack Based on Predictive AI Analysis of Traffic Patterns 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of using predictive AI in network traffic analysis?

   • ATo replace all other security controls, such as firewalls and IDS
   • BTo generate alerts only after a successful breach has been confirmed
   • CTo identify potential attack sequences by recognizing patterns that precede known malicious activity
   • DTo encrypt all network traffic to prevent eavesdropping
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A predictive AI system flags a workstation that regularly connects to a file-sharing website. The AI reports a high anomaly score because the workstation's traffic pattern shows a sudden increase in upload volume to that site during off-hours. The security team must decide whether this is a true positive. Which additional observation would most strongly support the AI's flag as a malicious exfiltration attempt?

   • AThe workstation's user is known to work late shifts and frequently uploads large files for collaboration.
   • BThe workstation also attempted to access an internal database server that it has never accessed before.
   • CThe file-sharing site is commonly used by other employees during business hours.
   • DThe workstation's antivirus software is up to date and no malware was detected.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A predictive AI system reconstructs the following attack sequence: (1) an attacker performs a port scan on a web server, (2) the web server sends an outbound connection to an external IP on port 4444, (3) the web server then begins communicating with an internal database server on a non-standard port, (4) the database server sends a large amount of data to the web server. The security team must decide the most critical point to interrupt the attack. Which action would be most effective?

   • ARun a vulnerability scan on the web server
   • BIsolate the web server from the network
   • CDisconnect the database server from the network
   • DBlock the external IP at the firewall
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which scenario would most likely be flagged by predictive AI as a malicious pattern rather than normal traffic?

   • AA user accessing a corporate web application during business hours
   • BA printer sending routine status updates to the print server
   • CA server sending a large volume of data to an external IP at 3:00 AM, deviating from its usual behavior
   • DA user streaming video from a legitimate corporate training site
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An AI alert flags a series of port scans from an external IP address. Which attack stage does this alert most likely correlate with?

   • ACommand and control
   • BPrivilege escalation
   • CData exfiltration
   • DReconnaissance
   Reveal Solution Discussion Select an answer first