3.4 Interpret the Sequence of Events During an Attack Based on Predictive AI Analysis of Traffic Patterns 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A predictive AI system flags a sequence of traffic patterns: a user authenticates from a new geolocation, then downloads a large file from an internal file server, then connects to a cloud storage provider. The AI assigns a high risk score. The analyst must decide whether this is a true attack or a false positive. Which additional context would most strongly support classifying this as a normal (non-malicious) pattern?

   • AThe cloud storage provider is a well-known vendor used by many employees.
   • BThe file server is configured to allow large downloads only during business hours.
   • CThe user is a known remote worker who frequently travels and uses a corporate VPN.
   • DThe user recently changed their password and enabled multi-factor authentication.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security analyst reviews a predictive AI dashboard that flags a sequence of events: at 09:12, a single external IP performs a slow port scan; at 09:18, the same IP sends a crafted HTTP request to a web server; at 09:25, the web server initiates outbound connections to an IP known for C2. The AI labels this as a likely attack chain. The analyst needs to document the attack stages in order. Which sequence correctly maps the AI-flagged events to the attack stages?

   • AReconnaissance → Exploitation → Command and Control
   • BExploitation → Reconnaissance → Command and Control
   • CCommand and Control → Reconnaissance → Exploitation
   • DReconnaissance → Command and Control → Exploitation
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A predictive AI system flags the following sequence for a finance department workstation: (1) the user receives a spear-phishing email with a malicious attachment, (2) the attachment exploits a zero-day vulnerability in the PDF reader, (3) the workstation establishes a connection to an external IP on port 443, (4) the workstation then begins accessing internal file shares and compressing files, (5) the compressed files are uploaded to a cloud storage service. The security team has limited resources and must decide the most effective single action to stop the attack. Which action should be taken?

   • ADisable the user's account
   • BPatch the PDF reader vulnerability
   • CIsolate the workstation from the network immediately
   • DBlock the external IP at the firewall
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A network team deploys a predictive AI tool that analyzes traffic patterns to detect attack sequences. The tool flags a series of small, periodic data transfers from a workstation to an external IP during off-hours. The analyst must determine if this is malicious. Which characteristic of the pattern would most likely cause the predictive AI to flag it as a potential attack sequence?

   • AThe transfers occur at regular intervals and match a known backup schedule.
   • BThe workstation is a new model recently deployed to the user.
   • CThe transfers are small and occur during off-hours, deviating from the user's normal activity baseline.
   • DThe external IP is a well-known cloud storage provider.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A predictive AI system reports the following sequence for a web application: (1) an attacker probes the application for SQL injection vulnerabilities, (2) a successful SQL injection is detected, (3) the attacker extracts database credentials, (4) the credentials are used to access a backend database. The security team must decide the most critical point to interrupt the attack. Which action would be most effective at breaking the attack chain?

   • AMonitor the database for unusual queries
   • BBlock the attacker's IP address
   • CPatch the SQL injection vulnerability in the web application
   • DRotate the database credentials
   Reveal Solution Discussion Select an answer first