Automate Security Workflows CY0-001 Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   A company has deployed an AI-driven automated threat detection system that generates alerts and automatically blocks malicious IPs. The security team wants to ensure the system is working correctly and not causing legitimate traffic to be blocked. Which strategy is most effective for monitoring and maintaining this system?

   • ADisable the automated blocking feature and only generate alerts for manual review.
   • BSet up dashboards to track alert volume, false positive rates, and blocked IPs, and review them weekly with the security team.
   • CRely on the AI vendor's support team to monitor the system and notify the company of any issues.
   • DConfigure the system to automatically block any IP that triggers an alert, without human review.
   Reveal Solution Discussion Select an answer first
2. 27foundation · medium

   Which approach is a valid way to integrate AI into an existing SIEM system?

   • AIgnoring the SIEM's alerts and relying on intuition.
   • BDeleting all SIEM logs to reduce noise.
   • CUsing the SIEM's API to feed data into an AI-based analytics module.
   • DReplacing the SIEM with a manual log review process.
   Reveal Solution Discussion Select an answer first
3. 28expert · hard

   A company has an AI-driven security automation platform that has been in production for six months. The security team notices that the false positive rate has been increasing over time. They suspect the model is not adapting to new attack patterns. What is the most likely cause and the best solution?

   • AThe model is not being retrained with new data, so it is missing new attack patterns; implement a regular retraining schedule with fresh data.
   • BThe model is being attacked by adversaries; implement adversarial training.
   • CThe security team is not providing enough feedback to the model; increase the amount of manual feedback.
   • DThe model is too complex and overfitting; simplify the model to reduce false positives.
   Reveal Solution Discussion Select an answer first