Apply AI Techniques in Operations CY0-001 Practice Questions (Page 6)

Questions 26–29

1. 26expert · hard

   A SOC is using an AI-powered incident response system that automatically correlates alerts and provides a summary of the incident. However, the analysts have lost trust in the system because it occasionally provides incorrect summaries that omit critical context, leading to delayed responses. The team wants to improve the system's reliability. Which approach is the MOST appropriate?

   • AIncrease the confidence threshold of the AI model so it only provides a summary when it is highly confident.
   • BRetrain the NLP model on a larger and more diverse dataset of incident reports to improve its accuracy.
   • CImplement a human-in-the-loop process where the AI provides a draft summary, and an analyst must review and approve it before it is used for decision-making.
   • DDisable the AI summarization feature and require analysts to manually review all raw logs and alerts.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team is planning its defenses for the next quarter. They have historical data on past cyberattacks, including the time of year, the attack vectors used, and the types of systems targeted. They want to use this data to proactively strengthen their defenses against the most likely future attacks. Which AI technique is BEST suited for this task?

   • AUse a predictive analytics model to forecast the probability of different attack types occurring in the next quarter.
   • BUse an automated threat intelligence platform to collect and aggregate data on current threats.
   • CUse an anomaly detection model to identify unusual activity in their current network traffic.
   • DUse a natural language processing model to analyze threat intelligence reports for mentions of upcoming attacks.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   During a major security incident, a SOC analyst is inundated with thousands of alerts, logs, and emails. The analyst needs to quickly understand the sequence of events and the attacker's actions to formulate a response. Which combination of AI techniques would MOST effectively assist the analyst in this time-critical situation?

   • AUse an anomaly detection model to identify which of the thousands of alerts are the most unusual.
   • BUse a predictive analytics model to forecast the attacker's next move and automatically block the predicted IP addresses.
   • CUse a supervised machine learning model to classify each email as phishing or legitimate.
   • DUse NLP to summarize the key entities and actions from the incident emails and logs, and use an AI-driven automation tool to correlate related alerts into a single incident timeline.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the main benefit of using AI to automate threat intelligence collection?

   • AIt guarantees the accuracy of all threat intelligence
   • BIt reduces the time and effort required to gather and process threat data from multiple sources
   • CIt replaces all commercial threat intelligence feeds
   • DIt eliminates the need for human analysts
   Reveal Solution Discussion Select an answer first