2.1 Recommend AI-powered Data Analytic Techniques to Meet Specific Needs or Answer Specific Questions 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is using a machine learning model that flags certain files as malicious. The model outputs a probability score, but the analyst needs to understand why a particular file was flagged to decide whether to quarantine it. Which approach would best help the analyst interpret the model's decision?

   • AIncrease the model's threshold to reduce false positives
   • BUse a different clustering algorithm to group the file with similar files
   • CRetrain the model with more data to improve accuracy
   • DUse model-agnostic explanation techniques such as SHAP or LIME to identify feature contributions
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A data scientist is preparing a dataset of network flow records to train a classification model that detects malicious traffic. The raw data contains IP addresses, port numbers, byte counts, and timestamps, but some features have very different scales and there are missing values. What should be done before feeding the data to the model?

   • AConvert all features to categorical values to make the model easier to train
   • BClean the data by handling missing values, normalize numerical features, and perform feature engineering
   • CRemove all features except IP addresses to simplify the model
   • DTrain the model directly on the raw data to avoid losing information
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC manager wants to deploy an AI-based anomaly detection system to alert on unusual network behavior. The team is concerned about the number of false positives overwhelming analysts. Which consideration is most important when recommending the technique?

   • AThe model's precision and the ability to tune the alert threshold
   • BThe model's training speed on large datasets
   • CThe model's ability to run on low-cost hardware
   • DThe model's use of deep learning rather than traditional statistics
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations team needs to identify workstations that are communicating with a newly discovered command-and-control domain. They have DNS logs showing which internal IPs queried the domain, but they also want to find other internal hosts that may be infected but have not yet queried the domain. Which AI-powered analytic technique should they use to find these potentially infected hosts?

   • AGraph analytics to map DNS query relationships and find hosts with similar query patterns
   • BTime-series analysis on DNS query volume per host
   • CRegression analysis to predict future DNS query counts
   • DClustering on all DNS queries to group hosts by total query volume
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which security question is best answered using time-series analysis?

   • AAre there any unusual spikes in network traffic during off-peak hours?
   • BIs this email phishing or legitimate?
   • CWhich files are similar to each other?
   • DWhat is the risk score of a user?
   Reveal Solution Discussion Select an answer first