3.4 Interpret the Sequence of Events During an Attack Based on Predictive AI Analysis of Traffic Patterns 350-201 Practice Questions (Page 8)

Questions 36–37

1. 36application · medium

   A predictive AI system flags a user's workstation for unusual outbound traffic to a file-sharing site. The AI notes that the user has uploaded 2 GB of data in the last hour, whereas the user's historical average is 50 MB per day. The user is a graphic designer who regularly shares large files. Which additional context would most likely indicate that this is a false positive?

   • AThe user recently changed their password and enabled multi-factor authentication.
   • BThe user's workstation has a scheduled backup that runs at the same time.
   • CThe user is currently working on a video project and has been uploading raw footage to a client for review.
   • DThe file-sharing site is used by other employees in the marketing department.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A predictive AI system produces the following alert sequence for a compromised host: (1) an unusual process spawns a PowerShell command, (2) the host makes an HTTP connection to a rarely visited domain, (3) the host transfers a large amount of data to that domain. The analyst must interpret the sequence. Which stage does the HTTP connection to the rarely visited domain represent?

   • AExfiltration
   • BCommand and Control
   • CReconnaissance
   • DExploitation
   Reveal Solution Discussion Select an answer first