AI for Security Threat Detection AIE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a common limitation of AI-based threat detection systems?

   • AThey are unable to process large volumes of data.
   • BThey are immune to adversarial manipulation.
   • CThey always require human intervention to make any decision.
   • DThey can generate false positives, flagging benign activity as malicious.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A financial institution is deploying an AI-based system to detect fraudulent transactions. The system must minimize false positives to avoid blocking legitimate customer purchases, but it must also catch new fraud patterns quickly. The data science team has access to historical transaction data with labels, but the fraud patterns change over time. Which strategy best balances these requirements?

   • AUse a supervised model trained on historical data and retrain it periodically with new labeled data
   • BDeploy an unsupervised anomaly detection model and never retrain it
   • CSet a very low threshold to catch all potential fraud
   • DUse a static rule-based system that was accurate in the past
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security team notices that their AI-based threat detection system frequently flags legitimate software updates as malicious. What is the most likely cause of this problem?

   • AThe system is too slow to process updates
   • BThe system is using a signature-based approach
   • CThe system is not connected to the internet
   • DThe training data did not include enough examples of legitimate software update behavior
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An organization's AI-based threat detection system is producing a large number of false positives, causing the security team to ignore alerts. What is the most effective way to address this issue?

   • AIgnore the false positives and focus only on high-severity alerts
   • BTune the model's threshold and retrain with more representative data
   • CDisable the AI system and rely on manual monitoring
   • DIncrease the number of alerts generated to ensure nothing is missed
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A financial institution is evaluating an AI-based phishing detection system. The system must minimize the risk of blocking legitimate customer emails while still catching phishing attempts. The team notices the model is currently flagging many legitimate emails as phishing. Which adjustment is most appropriate?

   • ALower the classification threshold so that only emails with very high phishing probability are flagged
   • BRemove all machine learning and use a manual review process
   • CRaise the classification threshold so that more emails are flagged as phishing
   • DIncrease the number of phishing emails in the training set without changing the threshold
   Reveal Solution Discussion Select an answer first