Enhance Detection and Response CY0-001 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's AI-driven detection system identifies a potential ransomware outbreak on a single endpoint. The automated incident response playbook is configured to isolate the endpoint from the network. However, the endpoint is a critical database server that cannot be taken offline during business hours. What is the most appropriate immediate action for the security team?

   • AAllow the automated isolation to proceed to contain the potential outbreak.
   • BOverride the automated isolation and manually investigate the alert while monitoring for lateral movement.
   • CIncrease the alert threshold for the detection system to prevent future false positives.
   • DImmediately shut down the endpoint to prevent further encryption.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A financial institution has deployed an AI-based detection system that monitors user behavior. The system flags an employee who is accessing files at 2 AM from a foreign IP address. The employee is a senior executive who frequently travels internationally. The security team must decide how to respond. The company has a strict policy that all alerts must be investigated, but the executive's activities are often legitimate. What is the best course of action?

   • AIgnore the alert because the executive's behavior is likely legitimate.
   • BAdd the executive to a permanent whitelist to prevent future alerts.
   • CAutomatically block the executive's account to prevent potential data exfiltration.
   • DInvestigate the alert, but consider the executive's travel patterns and legitimate business needs before taking action.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How does AI assist in vulnerability management?

   • ABy eliminating all vulnerabilities from the system.
   • BBy automatically identifying and prioritizing vulnerabilities based on risk, enabling efficient remediation.
   • CBy encrypting all data to prevent exploitation of vulnerabilities.
   • DBy replacing the need for vulnerability scanners.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which statement best describes the primary role of AI-driven threat detection in a security operations center?

   • AIt focuses solely on analyzing historical attack data to produce annual security reports.
   • BIt uses algorithms to analyze data and identify potential security threats in real time, often by recognizing patterns that indicate malicious activity.
   • CIt guarantees that no security breach will ever occur by predicting all possible attack vectors.
   • DIt replaces the need for human security analysts by automatically patching all vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A company wants to proactively identify systems that are most likely to be compromised in the next month based on current vulnerabilities and threat intelligence. Which AI approach is most suitable for this task?

   • ADeploy a honeypot to attract attackers and observe their behavior.
   • BReview firewall logs to identify past blocked attacks.
   • CConduct a penetration test to identify exploitable vulnerabilities.
   • DUse a predictive model that analyzes vulnerability data, exploit availability, and asset criticality to generate risk scores.
   Reveal Solution Discussion Select an answer first