Apply AI Techniques in Operations CY0-001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC is implementing an AI-driven automation to handle the initial response to phishing emails reported by employees. The automation is designed to collect the email, extract the URL, and check it against a threat intelligence feed. If the URL is malicious, the automation should automatically delete the email from all user mailboxes. What is the MOST significant risk associated with this automation?

   • AThe automation could delete a legitimate email if the threat intelligence feed has a false positive for the URL.
   • BThe automation might not be able to extract the URL from all email formats.
   • CThe automation might not be able to identify all reported phishing emails.
   • DThe automation might not be able to check the URL against the threat intelligence feed in a timely manner.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of AI-driven anomaly detection in security operations?

   • ATo block all network traffic that deviates from normal patterns
   • BTo classify malware based on known signatures
   • CTo identify deviations from established behavioral baselines that may indicate threats
   • DTo replace signature-based detection entirely
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is responsible for monitoring emerging threats. They currently spend several hours each day manually reading blog posts, forum discussions, and security vendor reports to find new indicators of compromise (IOCs). The analyst wants to automate this process to free up time for other tasks. Which AI technique is MOST directly applicable to this goal?

   • AUse a natural language processing model to scan the text of these sources and automatically extract IOCs like IP addresses, domains, and file hashes.
   • BUse an anomaly detection model to monitor the analyst's own network for signs of these new threats.
   • CUse a supervised machine learning model to classify the sentiment of the blog posts and forum discussions.
   • DUse a predictive analytics model to forecast which new malware families will emerge next month.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which task is most suitable for AI-driven automation in a security operations center (SOC)?

   • ANegotiating with threat actors
   • BTriage of low-severity alerts
   • CStrategic security planning
   • DDeveloping new security policies
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team has deployed an AI-based anomaly detection system to monitor user behavior. The system has a very low false positive rate, but the team is concerned that it might be missing sophisticated attackers who slowly escalate their privileges over several months. The team wants to improve the system's ability to detect this type of slow-and-low attack without significantly increasing the alert volume. Which approach is the MOST effective?

   • AIncrease the sensitivity of the anomaly detection model to flag any minor deviation from the user's baseline behavior.
   • BCombine the anomaly detection system with a rule-based automation that triggers an alert when a user's cumulative privilege or access level increases by a certain threshold over a defined period.
   • CRetrain the anomaly detection model on a longer baseline of user behavior to better learn 'normal' patterns over time.
   • DImplement a separate predictive analytics model that uses historical data to forecast a user's expected behavior and flags any deviation from this forecast.
   Reveal Solution Discussion Select an answer first