Artificial Intelligence Fundamentals GASAE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A red team is tasked with evaluating an AI-based intrusion detection system (IDS) that uses a neural network to classify network traffic. The team wants to determine whether the IDS can be evaded by an attacker who has no knowledge of the model's internals but can query it with crafted inputs. Which approach best matches this objective?

   • AFlood the network with high-volume traffic to cause a denial of service
   • BPerform a black-box adversarial attack by generating traffic samples that are misclassified while preserving the attack's intended function
   • CConduct a white-box attack using the model's gradients to craft minimal perturbations
   • DRun a penetration test against the IDS's management interface
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations center uses an AI-based email gateway that flags phishing attempts. The team notices that the model's detection rate drops sharply after a legitimate marketing campaign uses a new email template with unusual HTML structure. Which action best addresses the model's performance gap while minimizing disruption to operations?

   • AIncrease the model's confidence threshold so only very suspicious emails are flagged.
   • BSwitch to a rule-based filter that flags any email with non-standard HTML.
   • CRetrain the model with recent email samples that include the new template, then validate on a holdout set.
   • DImmediately block all emails with unusual HTML structure to prevent potential phishing.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security operations center (SOC) receives thousands of low-fidelity alerts daily. Analysts are overwhelmed and miss critical incidents. The SOC manager wants to use AI to improve detection without increasing headcount. Which approach best leverages AI for this goal?

   • AIncrease the logging verbosity of all security tools
   • BDeploy a supervised machine learning model that prioritizes alerts based on historical analyst decisions
   • CImplement a rule-based system that blocks all traffic from unfamiliar IP addresses
   • DHire additional analysts to manually review all alerts
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team wants to automate the initial triage of security alerts using AI. They have a large volume of historical alerts, some of which were confirmed as true positives and others as false positives. The team wants the system to learn from these past decisions to prioritize new alerts. Which AI approach should they use?

   • ATrain a supervised classification model on the historical alerts and their labels
   • BWrite static rules that match known attack signatures
   • CUse an unsupervised anomaly detection algorithm to find unusual alerts
   • DDeploy a reinforcement learning agent that randomly explores alert handling
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is planning an adversary emulation exercise against their AI-based endpoint detection and response (EDR) system. The goal is to test whether the EDR can detect a known attacker technique that uses PowerShell to download and execute a payload. The team has limited time and cannot modify the EDR's training data. Which approach best aligns with adversary emulation principles?

   • AInject malicious samples into the EDR's training data to see if it learns to detect them.
   • BExecute the PowerShell technique in a controlled lab environment and observe whether the EDR flags it.
   • CReview the EDR's detection rules and manually verify they cover the PowerShell technique.
   • DUse a different, more sophisticated technique that the EDR has never seen.
   Reveal Solution Discussion Select an answer first