Enhance Detection and Response CY0-001 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations center (SOC) analyst notices that a supervised machine learning model trained on historical network traffic is flagging a high volume of false positives during a major software rollout. The model was trained before the rollout and has not been updated. Which action should the analyst take to improve detection accuracy while minimizing disruption?

   • AIncrease the model's anomaly threshold to reduce the number of alerts generated.
   • BRetrain the model using a dataset that includes traffic samples from the new software rollout.
   • CDisable the model and rely on signature-based detection until the rollout is complete.
   • DManually whitelist all IP addresses associated with the software update servers.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team has identified over 500 vulnerabilities across their infrastructure. They have limited resources to remediate them all quickly. They want to use AI to help prioritize which vulnerabilities to fix first. Which factor should the AI model weigh most heavily when prioritizing?

   • AThe total number of vulnerabilities found on each system.
   • BThe ease of applying the patch, regardless of the vulnerability's severity.
   • CThe age of the vulnerability report.
   • DThe likelihood of exploitation and the potential impact on critical business systems.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is overwhelmed by the volume of threat intelligence feeds. The feeds contain indicators of compromise (IOCs) in various formats, including STIX/TAXII, CSV, and PDF reports. The analyst wants to automate the ingestion and correlation of this data to improve the organization's security posture. Which solution is most appropriate?

   • ADeploy an AI-based threat intelligence platform that normalizes, correlates, and enriches IOCs from all feeds.
   • BManually consolidate the IOCs into a single spreadsheet for review.
   • CSubscribe to only one threat intelligence feed to reduce the volume.
   • DUse a simple script to convert all feeds to a single text format.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which of the following is an example of AI-based threat intelligence analysis?

   • AManually reading security blogs to stay updated on new vulnerabilities.
   • BConfiguring a firewall to block all incoming traffic from unknown IP addresses.
   • CUsing an AI system to automatically correlate indicators of compromise (IOCs) from multiple feeds to identify emerging attack patterns.
   • DConducting a penetration test to identify vulnerabilities in the network.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is evaluating a machine learning solution to detect new malware variants. They have a large dataset of known malware samples and a smaller dataset of benign files. Which machine learning approach is best suited for this task?

   • AA rule-based system that uses a list of known malware hashes.
   • BUnsupervised learning with a clustering algorithm to group files based on similarity.
   • CReinforcement learning where the model is rewarded for correctly identifying malware.
   • DSupervised learning with a classification algorithm trained on labeled samples of malware and benign files.
   Reveal Solution Discussion Select an answer first