Identify AI Applications in Security CY0-001 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large organization wants to automate the response to common security incidents (e.g., phishing, malware) using AI. They have a mature SOAR platform but are concerned about the risk of automated actions causing unintended damage. They want to implement a system that can learn from past incidents and improve its response over time. What is the BEST approach?

   • AUse a static playbook that doesn't change based on past incidents
   • BUse a SOAR platform with machine learning that analyzes past incidents and recommends response actions, with human approval for new or high-risk actions
   • CDisable the SOAR platform and rely on manual response
   • DFully automate all response actions without human approval to maximize speed
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A cybersecurity team wants to proactively identify which of their systems are most likely to be targeted by a new ransomware campaign that is spreading globally. They have threat intelligence feeds, historical attack data, and system configuration information. Which AI application would BEST support this proactive effort?

   • AMalware analysis of the ransomware binary
   • BBehavioral analysis of user login patterns
   • CPredictive security model that scores systems based on their exposure and the current threat landscape
   • DIncident response automation that automatically patches all systems
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security engineer is evaluating an AI-based vulnerability management tool. The tool scans the environment and produces a list of vulnerabilities. The engineer wants to prioritize remediation efforts based on which vulnerabilities are MOST likely to be exploited. Which AI capability should the tool employ to BEST meet this need?

   • AIncident response automation that automatically patches all vulnerabilities
   • BPredictive analytics that uses threat intelligence and exploit data to score the likelihood of exploitation
   • CMalware classification of the vulnerability scanner's signature files
   • DBehavioral analysis of the scanning tool's own activity
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has deployed UEBA to detect insider threats. The system flags an employee who is working late and accessing files they normally don't access. However, the employee is a system administrator who is legitimately responding to an incident. The SOC team wants to reduce such false positives without disabling the UEBA system. What is the BEST approach?

   • ACreate an exception or allowlist for the administrator's account during incident response activities
   • BIncrease the anomaly threshold globally to reduce alerts
   • CDisable UEBA for all administrator accounts
   • DIgnore the alert and take no action
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A malware analyst receives a new, unknown binary that appears to be a variant of a known ransomware family. The analyst wants to quickly determine its family and capabilities. Which AI technique is MOST useful for this task?

   • APredictive security that forecasts when the binary will be used
   • BBehavioral analysis of the analyst's own system
   • CMachine learning classification that compares the binary's features to known malware families
   • DVulnerability management that scans the binary for vulnerabilities
   Reveal Solution Discussion Select an answer first