Apply AI Techniques in Operations CY0-001 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which scenario best illustrates the use of AI-driven anomaly detection?

   • AAn analyst manually reviews logs for suspicious activity
   • BA user logs in from a new geographic location at an unusual time
   • CA firewall blocks traffic based on a deny-all rule
   • DA known malware signature is matched in an email attachment
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An incident responder is investigating a data breach. They have a large number of emails from the attacker that were written in a foreign language. The responder needs to quickly understand the attacker's demands and any deadlines mentioned. Which AI technique would be MOST helpful in this situation?

   • AUse a predictive analytics model to forecast the attacker's next move based on the email content.
   • BUse an anomaly detection model to identify which emails are most unusual compared to the attacker's normal communication.
   • CUse a natural language processing model to translate the emails and extract key entities like dates, amounts, and demands.
   • DUse a supervised machine learning model to classify the emails as either 'demand' or 'negotiation'.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security team is evaluating a new AI-based intrusion detection system (IDS). The vendor claims it uses a supervised machine learning model. The team's network is highly dynamic, with new applications and services being deployed weekly. The team is concerned about the model's ability to adapt to these changes. What is the MOST important ongoing task to ensure the model remains effective?

   • ARely on the model's initial training data, as it was comprehensive and should cover most scenarios.
   • BSwitch to an unsupervised learning model that does not require labeled data and can adapt more easily.
   • CIncrease the model's sensitivity to detect any new traffic pattern as an anomaly.
   • DRegularly retrain the model with new, labeled data that reflects the current network traffic and applications.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which data source is most useful for training a predictive model to anticipate future cyberattacks?

   • AHistorical security incident logs
   • BEmployee training records
   • CVendor marketing materials
   • DCurrent network configuration files
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team has implemented an AI-based user and entity behavior analytics (UEBA) system. The system is generating a high number of alerts for a particular user who is a new executive. The user's behavior is significantly different from the rest of the company, but the team cannot confirm any malicious activity. The team is considering tuning the system. What is the MOST important consideration before making any changes?

   • AThe team should lower the anomaly detection threshold to reduce the number of alerts for this user.
   • BThe team should first investigate the executive's behavior to determine if it is benign, and if so, use this as a learning example to retrain the model on what is 'normal' for this user.
   • CThe executive's behavior is likely a false positive, so the team should immediately add the user to an allowlist to stop the alerts.
   • DThe team should increase the sensitivity of the anomaly detection model to get more data on the executive's behavior.
   Reveal Solution Discussion Select an answer first