Automate Security Workflows CY0-001 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team is overwhelmed by the number of alerts from their EDR, firewall, and cloud access security broker (CASB). They want to use AI to reduce alert fatigue by correlating alerts across these sources and presenting only high-priority incidents to analysts. Which approach is most effective?

   • AImplement an AI-driven security analytics platform that ingests alerts from all sources, correlates them, and creates prioritized incidents.
   • BAssign different analysts to monitor each tool separately.
   • CUse a SOAR platform to automatically close all low-severity alerts without review.
   • DIncrease the severity threshold in each tool so only critical alerts are sent to the SIEM.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company operates in a highly regulated industry and must ensure that its AI-based threat detection system does not produce biased outcomes that could lead to discrimination. They have a diverse user base and want to ensure the model performs equally well across all groups. They also need to maintain high detection rates. What is the most important step to achieve this?

   • ARegularly evaluate the model's performance metrics across different demographic groups and retrain with balanced data.
   • BSet a high detection threshold to reduce false positives, which will also reduce bias.
   • CRely on the AI vendor's claim that their model is unbiased.
   • DUse a complex deep learning model that is known to be more accurate.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise has a mature security operations center with a SIEM, SOAR, and multiple point products. They want to automate incident response for common threats, but they have a strict compliance requirement that all automated actions must be logged and reviewed by a human within 24 hours. They also have a limited budget and cannot afford a full-time AI engineer. Which approach best meets these constraints?

   • ADevelop a custom AI model using open-source libraries and integrate it with the SIEM via API.
   • BPurchase a new AI-native SOAR platform that includes automated response and built-in audit logging.
   • COutsource incident response to a managed security service provider (MSSP) that uses AI automation.
   • DUse the existing SOAR platform's built-in playbooks with pre-built connectors, and configure them to require human approval for actions that are not reversible.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to detect insider threats by analyzing user behavior across their network. They have a SIEM that collects logs from endpoints, authentication servers, and data loss prevention tools. They want to integrate an AI model that can identify anomalous behavior patterns and automatically create alerts for the security team. What is the most effective way to integrate this AI capability?

   • ADeploy a user and entity behavior analytics (UEBA) tool that ingests SIEM data and uses machine learning to baseline normal behavior and flag deviations.
   • BCreate a static rule in the SIEM that triggers an alert whenever a user accesses more than 10 files in an hour.
   • CInstall a network-based intrusion prevention system (IPS) inline and configure it to block any traffic that matches known attack signatures.
   • DUse a vulnerability scanner to identify missing patches on user workstations and automatically deploy them.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization has implemented an AI-based automated incident response system that can contain threats. They want to ensure that the system's decisions are transparent and can be audited. What should they implement?

   • AUse a black-box AI model that does not provide explanations for its decisions.
   • BDisable the AI system and rely on manual incident response to ensure transparency.
   • COnly allow the AI to suggest actions, not take them, to ensure human oversight.
   • DEnable detailed logging of all AI decisions, including the input data, model version, and actions taken, and store these logs in a tamper-evident manner.
   Reveal Solution Discussion Select an answer first