2.1 Recommend AI-powered Data Analytic Techniques to Meet Specific Needs or Answer Specific Questions 350-201 Practice Questions (Page 11)

Questions 51–55

1. 51foundation · easy

   What is the primary purpose of a classification algorithm in cybersecurity?

   • ATo group similar data points without predefined labels
   • BTo predict continuous values such as CPU usage
   • CTo assign data points to predefined categories
   • DTo reduce the dimensionality of the data
   Reveal Solution Discussion Select an answer first
2. 52application · medium

   A security team has developed a model to detect phishing emails. In a test set, the model correctly identified 95% of actual phishing emails, but it also flagged 20% of legitimate emails as phishing. The team is concerned about the impact on user productivity. Which metric should they focus on to evaluate and improve the model?

   • AAccuracy, because it measures overall correctness
   • BRecall, because it measures the proportion of actual phishing emails correctly identified
   • CF1-score, because it balances precision and recall
   • DPrecision, because it measures the proportion of flagged emails that are actually phishing
   Reveal Solution Discussion Select an answer first
4. 53expert · hard

   A security team has developed a model to detect network intrusions. The model has an overall accuracy of 99%, but it fails to detect most rare attacks, which are the most critical. The team wants to ensure the model is effective for the SOC's needs. Which evaluation metric should they prioritize?

   • ARecall for the attack class
   • BF1-score for the benign class
   • COverall accuracy
   • DPrecision for the benign class
   Reveal Solution Discussion Select an answer first
5. 54application · medium

   A network analyst wants to discover new types of network attacks without prior knowledge of attack signatures. They have a large dataset of network flows with features like source IP, destination IP, port, and packet size. The goal is to group similar flows together to identify unusual patterns that might represent novel attacks. Which technique should they use?

   • AClustering the flows based on feature similarity
   • BNLP to parse flow logs as text
   • CSupervised classification using labeled attack and benign flows
   • DRegression analysis to predict the number of packets per flow
   Reveal Solution Discussion Select an answer first
6. 55foundation · easy

   Which metric is most appropriate when the cost of missing a true positive is very high, such as missing a malware infection?

   • AF1-score
   • BAccuracy
   • CPrecision
   • DRecall
   Reveal Solution Discussion Select an answer first