Describe How AI Is Used in the Security App ELASTIC-CERTIFIED-SIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does AI assist in identifying and prioritizing potential threats in the Elastic Security App?

   • ABy automatically blocking all suspicious network traffic
   • BBy requiring analysts to manually review every alert before AI can act
   • CBy analyzing patterns and anomalies to highlight and rank potential threats
   • DBy replacing all existing detection rules with machine learning models
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security administrator wants to customize the AI model used in the Elastic Security App to better detect threats specific to their organization's environment. The administrator has a set of labeled historical alerts that represent known true and false positives. What is the most appropriate way to configure the AI model using this data?

   • ACreate a new index pattern to store the labeled data for future reference.
   • BManually adjust the alert severity thresholds in each detection rule.
   • CUpload the labeled data to retrain the model within the Security App's AI model management settings.
   • DDisable the AI features and rely on manual rule-based detection.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is new to the Elastic Security App and wants to understand how AI features can assist with daily tasks. The analyst reads the documentation and learns that AI in the Security App serves multiple purposes. Which statement best describes the overall role of AI in the Security App?

   • AAI is a standalone feature that operates independently of other Security App components.
   • BAI replaces the need for human analysts by fully automating security operations.
   • CAI enhances detection, investigation, and triage by providing intelligent assistance and automation.
   • DAI is only used for generating reports and visualizations.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security team is concerned about the ethical implications of using AI in the Elastic Security App, particularly regarding bias in threat detection. They want to ensure that the AI does not unfairly flag certain user groups. Which practice should the team adopt to address this concern?

   • ARely on the AI model's outputs without review because it is objective.
   • BRegularly audit the AI model's outputs for bias and adjust the model or data accordingly.
   • CDisable AI features to avoid any potential bias.
   • DIncrease the AI model's sensitivity to ensure all users are flagged equally.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An analyst is using natural language processing in the Elastic Security App to query data. The analyst asks, 'Show me all alerts from the last hour that are related to the marketing department.' The AI returns an error because it cannot find the 'marketing department' as a field. What is the most likely reason for this error?

   • AThe AI does not have access to the marketing department's data due to permissions.
   • BThe AI is overloaded and cannot process the query.
   • CThe AI is not configured to handle queries about departments.
   • DThe AI cannot map the natural language term 'marketing department' to a specific field in the data.
   Reveal Solution Discussion Select an answer first