2.1 Recommend AI-powered Data Analytic Techniques to Meet Specific Needs or Answer Specific Questions 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A large enterprise has a threat intelligence team that manually reads thousands of security advisories and blog posts to extract IOCs and understand attack campaigns. They also have a graph database of known attack paths. Management wants to automate the extraction of IOCs and also identify which existing attack paths might be affected by new campaigns. The team has no labeled data for the text. Which combination of techniques should be recommended?

   • AUse supervised classification to label the text as 'relevant' or 'not relevant', then use regression to predict the number of affected paths
   • BUse NLP to extract IOCs and then use graph analytics to map the extracted IOCs to existing attack paths
   • CUse anomaly detection on the graph database to find unusual paths, then use NLP to write summaries
   • DUse clustering to group similar advisories, then use time-series analysis to predict when the next campaign will occur
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is preparing a dataset to train a model that detects malicious PowerShell commands. The raw data includes the full command text, the user who ran it, the timestamp, and the hostname. The team wants to use NLP to analyze the command text. Which preprocessing step is most critical to ensure the model learns meaningful patterns?

   • ARemove all punctuation from the command text
   • BEncode the hostname as a categorical variable
   • CNormalize the timestamp to a standard format
   • DTokenize the command text and remove common words that do not add security value
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the main goal of interpreting AI model outputs in cybersecurity?

   • ATo replace the need for security analysts
   • BTo derive actionable insights that support security decision-making
   • CTo automatically block all flagged alerts without human review
   • DTo increase the number of alerts generated
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network team observes that a server's outbound traffic volume has been gradually increasing over the past three weeks, but the pattern is not a sudden spike. They want to determine whether this is a normal trend or a sign of data exfiltration. Which AI technique would be most appropriate to analyze this gradual change?

   • AGraph analytics to map connections between the server and external IPs
   • BTime-series analysis to model the trend and detect deviations from the expected pattern
   • CClustering to group days with similar traffic volumes
   • DClassification to label each day as 'normal' or 'anomalous' based on traffic volume
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the main goal of clustering algorithms in cybersecurity analytics?

   • ATo group similar data points together based on their features
   • BTo reduce the number of features in the dataset
   • CTo assign data points to predefined categories
   • DTo predict future values based on historical data
   Reveal Solution Discussion Select an answer first