3.4 Interpret the Sequence of Events During an Attack Based on Predictive AI Analysis of Traffic Patterns 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A predictive AI tool identifies a multi-stage attack in progress: (1) a phishing email is opened, (2) a macro downloads a payload, (3) the payload establishes persistence, (4) the host begins scanning the internal network. The incident response team must act quickly. Which action should be prioritized based on the AI-inferred sequence?

   • ADisable the user's account.
   • BDelete the macro from the email attachment.
   • CBlock the phishing email sender's address.
   • DIsolate the affected host from the network.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How does predictive AI analyze network traffic to identify potential attack sequences?

   • ABy isolating any device that sends more than a fixed number of packets per second
   • BBy comparing current traffic against historical baselines and known attack progression models to forecast likely next steps
   • CBy blocking all traffic that matches a signature of a known malware sample
   • DBy requiring a human analyst to manually label every traffic flow before it is analyzed
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How can insights from predictive AI analysis inform incident response prioritization?

   • ABy providing a list of all employees who have accessed the network
   • BBy identifying which alerts are part of a predicted attack sequence, allowing responders to focus on the most critical stages
   • CBy guaranteeing that no further attacks will occur
   • DBy automatically deleting all logs related to the incident
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A predictive AI system reports the following sequence for a compromised host: (1) a user opens a malicious document, (2) a macro downloads a payload, (3) the payload establishes persistence, (4) the host begins scanning the internal network. The incident response team has limited resources and must prioritize actions. Which action should be taken FIRST?

   • ADelete the scheduled task created by the payload.
   • BBlock the malicious document's download URL.
   • CDisable the user's account.
   • DIsolate the host from the network.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A predictive AI tool flags a server that is sending large amounts of data to an external IP at 2 AM. The server is a backup server that normally performs off-site replication between 1 AM and 3 AM. The AI's anomaly score is high because the destination IP is in a foreign country. Which additional piece of information would most likely indicate that this is a false positive?

   • AThe server has never communicated with that IP before.
   • BThe backup server's replication job is configured to use a cloud provider with data centers in that country.
   • CThe data transfer volume is 10 times higher than the usual backup size.
   • DThe server's administrator recently changed the backup schedule to include 2 AM.
   Reveal Solution Discussion Select an answer first