Enhance Detection and Response CY0-001 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary benefit of using AI to aggregate and analyze threat intelligence data?

   • AIt provides a comprehensive view of the threat landscape by correlating data from multiple sources, improving the organization's security posture.
   • BIt automatically patches all vulnerabilities in the organization's systems.
   • CIt replaces the need for traditional security tools like firewalls.
   • DIt eliminates the need for human security analysts.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common application of NLP in security analytics?

   • AConfiguring network firewalls to block specific IP addresses.
   • BEncrypting emails to prevent unauthorized access.
   • CAutomatically summarizing and categorizing security incident reports.
   • DHashing passwords to store them securely.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary role of machine learning models in enhancing security measures?

   • ATo replace all traditional security tools with AI-based solutions.
   • BTo automatically apply security patches to all systems without human oversight.
   • CTo encrypt all data at rest and in transit.
   • DTo learn from data to identify patterns and make predictions that improve threat detection and response.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large organization is using an AI-enhanced SIEM to analyze security data. The SIEM generates a high number of alerts, and the security team is experiencing alert fatigue. They want to use AI to reduce the number of false positives while maintaining high detection rates. Which approach is most effective?

   • AManually review all alerts and create a list of known false positives to ignore.
   • BDisable all SIEM rules and rely on the AI model to detect all threats.
   • CUse a supervised machine learning model trained on historical alerts that have been labeled as true positives or false positives.
   • DIncrease the threshold for all SIEM rules to generate fewer alerts.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has a vulnerability management program that uses an AI tool to prioritize vulnerabilities. The tool assigns a risk score to each vulnerability based on CVSS score, exploit availability, and asset criticality. However, the security team is concerned that the tool is not accounting for the 'blast radius' of a vulnerability (i.e., the potential impact if it is exploited). How should the team adjust the tool's configuration?

   • AIncrease the weight of the CVSS score in the risk calculation.
   • BAdd a factor for asset criticality that reflects the importance of the system and the potential impact of a breach.
   • CRemove the asset criticality factor to simplify the model.
   • DUse a static list of critical assets and manually adjust their risk scores.
   Reveal Solution Discussion Select an answer first