2.1 Recommend AI-powered Data Analytic Techniques to Meet Specific Needs or Answer Specific Questions 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a common limitation of AI analytics in cybersecurity?

   • AIt eliminates the need for human analysts
   • BIt always requires labeled data
   • CIt can produce false positives that overwhelm security analysts
   • DIt cannot handle large volumes of data
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is building a model to detect phishing URLs. They have a dataset with many features, and they have tried several individual models. Each model has different strengths: one has high precision, another has high recall, and a third is good at detecting new phishing patterns. The team wants to combine these models to achieve the best overall performance. Which approach should they use?

   • AUse only the model with the highest recall
   • BUse a regression model to combine the risk scores
   • CUse only the model with the highest precision
   • DUse a voting ensemble that combines the predictions of all models
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team wants to discover groups of similar malware samples in their repository to identify new malware families. They do not have labels for the samples. Which AI technique should they use to group the samples based on their behavioral features?

   • ATime-series analysis on the submission dates of the samples
   • BSupervised classification using known malware family labels
   • CRegression analysis to predict a malware severity score
   • DClustering algorithms such as k-means or DBSCAN to group similar samples
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which scenario best illustrates the use of AI analytics for threat hunting?

   • AAn analyst manually reviews logs to find indicators of compromise.
   • BA firewall updates its signature database daily.
   • CA model identifies subtle patterns in historical data that correlate with known attacker behavior.
   • DA system automatically blocks all traffic from a specific IP address.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team has deployed an AI-based intrusion detection system that uses anomaly detection. The system generates a high number of alerts, and the team is spending too much time investigating false positives. They want to reduce the alert volume while still catching true attacks. The team has a small set of confirmed attack alerts from past incidents. Which approach should they take?

   • AUse the confirmed attack alerts to train a supervised classifier that can prioritize or filter the anomaly alerts
   • BSwitch to a regression model to predict the number of attacks per day
   • CIncrease the amount of telemetry data collected to improve the anomaly detection model
   • DTune the anomaly detection threshold to be more sensitive to reduce false positives
   Reveal Solution Discussion Select an answer first