AI for Security Threat Detection AIE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which AI technique is commonly used to detect security threats by identifying data points that deviate from established normal behavior?

   • AComputer vision
   • BNatural language processing
   • CSpeech recognition
   • DAnomaly detection
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network administrator wants to detect insider threats where employees access files outside their normal work patterns. The system should learn what is normal for each user and alert on deviations. Which AI technique is best suited?

   • ASignature-based intrusion detection
   • BBehavioral analysis using user and entity behavior analytics (UEBA)
   • CStatic rule that alerts when any file is accessed after 6 PM
   • DManual review of access logs by the administrator
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security vendor claims their AI-based malware detector has a 99.9% detection rate. A company is considering buying it, but the vendor also mentions the false positive rate is 5%. The company receives about 10,000 files per day. What is the most important consideration for the company?

   • AThe high false positive rate will generate about 500 alerts per day, which may overwhelm the security team
   • BThe detection rate is too low to be useful
   • CThe company should only rely on the detection rate and ignore false positives
   • DThe vendor should guarantee a 0% false positive rate
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational company wants to deploy an AI-based intrusion detection system across its global network. The system must comply with data residency regulations that require security logs to stay within the country where they are collected. The company also wants to centralize analysis for efficiency. Which approach best satisfies both requirements?

   • ADeploy regional AI-based detection nodes that process and store logs locally, with only aggregated alerts sent to a central SIEM
   • BSend all raw logs to a central location in a different country for analysis
   • CDisable AI detection and rely on manual analysis in each country
   • DUse a single global model that is trained on all logs in one location
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is tuning an AI-based malware detector. They need to minimize the chance that an attacker can craft malicious files that the model classifies as benign. Which approach directly addresses this limitation?

   • AAdversarial training with perturbed malware samples
   • BIncreasing the model's detection threshold to reduce false positives
   • CUsing only signature-based detection alongside the AI model
   • DCollecting more benign samples for training
   Reveal Solution Discussion Select an answer first