Using Automation and AI for Detection Engineering and Incident Response GASAE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A SOC is overwhelmed by false positives. They want to use AI to prioritize incidents so that analysts focus on the most critical threats. The team has historical data on which alerts were true positives and which were false positives. What is the most effective way to build this AI-based prioritization system?

   • ATrain a supervised model on historical alert data with labels indicating true/false positives, and use its probability score to rank the incident queue.
   • BAsk analysts to manually re-prioritize alerts each day and use that feedback to adjust the queue.
   • CRandomly sample alerts for deep analysis and prioritize those that match known threat intelligence.
   • DUse a rule-based system that assigns priority based solely on the alert's severity field.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team maintains a large SIEM with hundreds of custom detection rules. Each week, analysts manually review new threat intelligence reports and write new rules, which then require a separate change-management approval before deployment. The team wants to reduce the time from intelligence publication to rule deployment while maintaining human oversight. Which approach best achieves this while preserving the required approval gate?

   • AHave the AI model directly modify the SIEM's production rule set and schedule a weekly report of changes for the analysts to review after deployment.
   • BUse the AI model to prioritize which intelligence reports the analysts should read, but continue having analysts manually write all rules as they do today.
   • CUse an AI model to generate candidate rules from the intelligence reports, then route them through the existing change-management workflow for analyst review and approval before deployment.
   • DCreate a fully automated pipeline that ingests intelligence, generates rules, tests them against historical data, and deploys them to production without human intervention.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization uses a SOAR platform and wants to integrate an AI-based chatbot that analysts can query for incident context and suggested next steps. The chatbot should not take any actions on its own. What is the best way to integrate this chatbot?

   • AAllow the chatbot to execute playbooks directly when an analyst asks for a suggestion.
   • BUse the chatbot to replace the SOAR platform's orchestration engine.
   • CConnect the chatbot to the SOAR platform's API to read incident data and provide recommendations, but require analyst confirmation for any action.
   • DHave the chatbot send emails to analysts with incident summaries.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team has deployed an AI-based alert prioritization system. After three months, they notice that analysts are still spending a lot of time on low-priority alerts. They want to assess the system's performance and improve it. What is the first step they should take?

   • ARetrain the model on the same historical data to see if performance improves.
   • BReview the system's precision and recall metrics against a labeled test set, and analyze cases where the system ranked true positives as low priority.
   • CIncrease the priority threshold so that more alerts are considered high priority.
   • DDisable the AI system and return to manual prioritization.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a key benefit of using AI to prioritize incidents in a security operations center?

   • AAll incidents are automatically resolved without human intervention
   • BAnalysts can focus their efforts on incidents that are most likely to be critical based on learned patterns
   • CEvery alert is guaranteed to be a true positive
   • DThe need for any human analyst in the SOC is eliminated
   Reveal Solution Discussion Select an answer first