Using Automation and AI for Detection Engineering and Incident Response GASAE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team has deployed an automated detection rule that uses an AI model to identify malicious PowerShell commands. The rule has a high false positive rate, causing alert fatigue. The team wants to improve the rule's precision without significantly reducing recall. What is the best approach?

   • AAdd a secondary filter that checks if the PowerShell command is signed by a trusted publisher, and suppress alerts for signed commands.
   • BRetrain the model on a larger dataset of PowerShell commands.
   • CDisable the rule and rely on manual analysis of PowerShell logs.
   • DIncrease the model's confidence threshold to reduce false positives, accepting a lower recall.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization uses a SIEM and a ticketing system. They want to integrate an AI-based alert triage tool into their existing incident response workflow. The tool should enrich alerts with threat intelligence and suggest response actions, but analysts must approve any automated action. What is the best way to integrate this tool?

   • AConfigure the SIEM to send alerts to the AI tool, which enriches them and creates a ticket with suggested actions; the analyst reviews and approves before any action is taken.
   • BReplace the SIEM with the AI tool and have it manage all detection and response.
   • CUse the AI tool only for reporting and do not connect it to the ticketing system.
   • DHave the AI tool directly execute containment actions on all alerts without analyst involvement.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A detection engineering team has developed a new AI model that generates potential detection rules from network traffic data. Before deploying any of these rules to production, the team wants to validate their effectiveness. Which validation approach provides the most reliable evidence that a generated rule will work correctly in the live environment?

   • ACompare the new rule's output with the output of an existing, well-established rule for the same attack.
   • BHave a senior analyst review the rule's syntax and logic to ensure it aligns with the known attack pattern.
   • CDeploy the rule in a test mode that logs matches but does not alert, and compare the results with a separate sandbox environment.
   • DRun the generated rules against a replay of historical network traffic that includes known benign and malicious samples, and measure the detection rate and false positive rate.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of an automated incident response playbook?

   • ATo replace the need for human incident responders entirely
   • BTo document past incidents for compliance reporting only
   • CTo orchestrate predefined response actions automatically when a detection alert is triggered
   • DTo generate detection rules based on threat intelligence
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A SOC has deployed an AI model that generates a risk score for each alert. The model was trained on historical data where the true positive rate was 1% (i.e., 1 in 100 alerts was a real incident). After deployment, the SOC notices that the model is flagging 10% of all alerts as high-risk. The SOC's analysts are overwhelmed and are ignoring the high-risk alerts. What is the most likely cause of this problem, and what is the best adjustment?

   • AThe model is not being retrained on new data, so it is using outdated patterns, and the model should be retrained on the most recent alerts.
   • BThe model is correctly identifying a new, widespread threat that is causing a legitimate increase in high-risk alerts, so no adjustment is needed.
   • CThe model is overfitting to the training data and is not generalizing well to new alerts, so the model should be retrained with more diverse data.
   • DThe model's threshold for 'high-risk' is set too low, causing it to flag too many alerts, so the threshold should be raised to reduce the number of high-risk alerts.
   Reveal Solution Discussion Select an answer first