Enhance Detection and Response CY0-001 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following best describes how a machine learning model is used in threat detection?

   • AIt uses a fixed set of rules to match known attack signatures.
   • BIt is trained on labeled data to classify network traffic as benign or malicious.
   • CIt generates random security policies for the organization.
   • DIt manually reviews each alert to determine if it is a true positive.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of an automated response to a detected security incident?

   • AAn administrator updates firewall rules manually after receiving an alert.
   • BA security system automatically quarantines an infected endpoint after detecting malicious activity.
   • CA security team holds a meeting to discuss a potential threat.
   • DAn analyst manually reviews a log entry and decides to block an IP address.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security team is using an NLP-based system to analyze security incident reports. The system is supposed to automatically classify incidents by type (e.g., malware, phishing, DDoS) and extract key entities. However, the system is misclassifying many incidents because the reports use inconsistent terminology (e.g., 'phishing' vs. 'spear phishing' vs. 'email scam'). What is the best way to improve the system's accuracy?

   • AUse a more advanced NLP model that can understand context and synonyms, such as a transformer-based model.
   • BReduce the number of incident categories to make classification easier.
   • CProvide the model with a larger dataset of incident reports.
   • DManually review and reclassify all misclassified incidents.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team wants to automatically extract indicators of compromise (IOCs) from unstructured threat reports, blog posts, and security advisories. Which AI capability is most directly applicable to this task?

   • AClustering algorithms to group similar malware samples.
   • BPredictive modeling to forecast future attack trends.
   • CAnomaly detection to identify unusual patterns in network traffic.
   • DNatural language processing (NLP) to parse text and identify entities like IP addresses, domains, and file hashes.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary goal of predictive security with AI?

   • ATo encrypt all data to prevent breaches.
   • BTo automatically respond to incidents after they have occurred.
   • CTo replace the need for security monitoring.
   • DTo predict potential security incidents before they occur, allowing proactive mitigation.
   Reveal Solution Discussion Select an answer first