A security analyst is explaining to management why a neural network-based malware detector may fail to detect a new variant that is only slightly different from known malware. Which concept best explains this behavior?

The model is too simple to learn any patterns from the data.

The model has been poisoned by an attacker during training.

The model's activation functions are not suitable for malware detection.

The model may have overfit to the training data and lacks generalization to unseen variations.

A security team wants to automate the triage of security alerts using machine learning. They have a historical dataset of alerts that were manually classified as true or false positives. Which approach best leverages AI to reduce analyst workload while maintaining accuracy?

Deploy a rule-based system that flags alerts based on static thresholds.

Use an unsupervised clustering algorithm to group similar alerts and present one representative per cluster.

Train a supervised classifier on the historical data to predict the likelihood that a new alert is a true positive.

Automatically suppress all alerts that are similar to previously confirmed false positives.

A security team has developed an AI model to detect malicious network traffic. Before deployment, they want to test its robustness against adversarial examples. Which evaluation approach is most appropriate?

Deploy the model and monitor its performance in production without any prior testing.

Generate adversarial examples using a separate attack algorithm and measure the model's accuracy on them.

Evaluate the model only on a standard test set of benign and malicious traffic.

Check the model's training loss to ensure it converged.

A security team has deployed an AI-based phishing detector. They want to evaluate its robustness against adversarial attacks before full deployment. They have a test set of legitimate and phishing emails. Which evaluation method best assesses the model's resistance to evasion?

Generate adversarial examples from the test set and measure the model's accuracy on them

Evaluate the model's performance on a separate holdout set of normal emails

Check the model's API response latency

Measure the model's training time on the test set

What is the purpose of testing an AI security tool against a held-out dataset that was not used during training?

To increase the model's accuracy by providing more training examples

To ensure the model runs faster in production

To evaluate how well the model generalizes to new, unseen data

To reduce the model's false positive rate by tuning thresholds

GIAC AI Security Automation Engineer

Domain 3Objective 1

Artificial Intelligence Fundamentals GASAE Practice Questions (Page 4)

Part of the AI and Adversary Emulation domain, which makes up ~19% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–23 in this domain), expect 7–12 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

5concepts

Questions 16–20

16application · medium
A security analyst is explaining to management why a neural network-based malware detector may fail to detect a new variant that is only slightly different from known malware. Which concept best explains this behavior?
Select an answer first
17application · medium
A security team wants to automate the triage of security alerts using machine learning. They have a historical dataset of alerts that were manually classified as true or false positives. Which approach best leverages AI to reduce analyst workload while maintaining accuracy?
Select an answer first
18application · medium
A security team has developed an AI model to detect malicious network traffic. Before deployment, they want to test its robustness against adversarial examples. Which evaluation approach is most appropriate?
Select an answer first
19application · medium
A security team has deployed an AI-based phishing detector. They want to evaluate its robustness against adversarial attacks before full deployment. They have a test set of legitimate and phishing emails. Which evaluation method best assesses the model's resistance to evasion?
Select an answer first
20foundation · easy
What is the purpose of testing an AI security tool against a held-out dataset that was not used during training?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GASAE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GASAE” is a trademark of its owner, used for identification only.