2.1 Recommend AI-powered Data Analytic Techniques to Meet Specific Needs or Answer Specific Questions 350-201 Practice Questions (Page 12)

Questions 56–60

1. 56foundation · easy

   What is a key characteristic that distinguishes AI-powered data analytics from traditional analytics in cybersecurity?

   • AIt only works with structured data such as logs and network flows.
   • BIt automatically learns patterns from data and adapts to new or evolving threats.
   • CIt relies on predefined rules and static thresholds to detect known threats.
   • DIt requires manual tuning of detection rules by security analysts.
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   What type of outcome is regression analysis used to predict?

   • AContinuous numeric values such as CPU usage or risk scores
   • BGroups of similar data points
   • CAnomalies in network traffic
   • DCategorical labels such as 'malicious' or 'benign'
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   A threat intelligence team receives thousands of unstructured security blog posts and incident reports daily. They need to automatically extract indicators of compromise (IOCs) such as IP addresses, domains, and file hashes, and also identify the tactics, techniques, and procedures (TTPs) mentioned. Which AI-powered technique should they use?

   • ATime-series analysis on the publication dates of the reports
   • BRegression analysis to predict the number of IOCs per report
   • CClustering the reports by length to group similar documents
   • DNatural language processing (NLP) to parse and extract entities and relationships from the text
   Reveal Solution Discussion Select an answer first
5. 59expert · hard

   A security vendor is building a product that detects malicious PowerShell scripts. They have a large dataset of scripts, but only a small portion is labeled as malicious. The labeled data is highly reliable, but the unlabeled data contains many more examples. The team wants to maximize detection accuracy while minimizing the effort of manual labeling. Which approach should they recommend?

   • AUse regression to predict a maliciousness score for each script
   • BUse semi-supervised learning that leverages both labeled and unlabeled data to improve the classifier
   • CUse only unsupervised clustering and then manually label the clusters
   • DUse only the labeled data to train a supervised classifier and ignore the unlabeled data
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   A security team wants to train a supervised classification model to detect malicious network connections. Their raw dataset includes connection timestamps, IP addresses, port numbers, and byte counts. The team notices that the model performs poorly because some features have very different scales (e.g., byte counts in millions vs. port numbers in the hundreds). Which preprocessing step is most important to apply before training?

   • AConvert all features to categorical variables
   • BNormalize or standardize the numerical features
   • CRemove all IP addresses from the dataset
   • DIncrease the number of training epochs
   Reveal Solution Discussion Select an answer first