AI for Security Threat Detection AIE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization deploys an AI-based intrusion detection system (IDS) that generates a high number of alerts, most of which turn out to be benign. The security team is overwhelmed and may miss real threats. What is the primary challenge being experienced?

   • ALack of real-time monitoring
   • BHigh false positive rate
   • CInsufficient training data
   • DAdversarial attacks on the AI model
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security manager is considering using AI to automate threat detection but is worried about the system making mistakes. What is the most realistic expectation to set?

   • AAI will only produce alerts for confirmed threats
   • BAI will never make mistakes if trained on enough data
   • CAI will reduce the workload but still require human oversight to handle ambiguous cases
   • DAI will completely replace the need for human security analysts
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following is an example of behavioral analysis applied to security threat detection?

   • APatching operating system vulnerabilities.
   • BConfiguring a firewall to block specific IP addresses.
   • CMonitoring user login times and flagging access at unusual hours as potentially suspicious.
   • DEncrypting all data stored in a database.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security operations center (SOC) analyst needs to identify a new type of malware that does not match any known signature. The organization wants to detect such threats without relying on pre-defined indicators of compromise. Which AI technique should the analyst use?

   • ARule-based alerting on specific port numbers and IP addresses
   • BSignature-based scanning with a regularly updated virus database
   • CManual review of all endpoint logs by the SOC team
   • DAnomaly detection on network traffic and endpoint behavior
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A large enterprise has a mature SIEM and a team of security analysts. They want to reduce alert fatigue while still detecting sophisticated attacks that evade signature-based tools. They are considering two options: (1) tuning the SIEM correlation rules, or (2) deploying an AI-based user and entity behavior analytics (UEBA) system. Which approach is most effective for this goal?

   • ATune the SIEM correlation rules to reduce false positives
   • BDeploy the UEBA system to baseline normal behavior and flag deviations
   • CIncrease the number of SIEM alerts to capture more events
   • DReplace the SIEM with a standalone antivirus solution
   Reveal Solution Discussion Select an answer first