Using Automation and AI for Detection Engineering and Incident Response GASAE Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A SOC uses an AI model to triage alerts. The model currently has a precision of 0.95 for true positives and a recall of 0.60. The SOC is missing too many true positives, so they want to improve recall. However, they are concerned that improving recall will increase the false positive rate and overwhelm analysts. What is the best approach to improve recall while managing false positives?

   • ARaise the confidence threshold to reduce false positives, accepting lower recall.
   • BRetrain the model on the same data with more epochs to improve recall.
   • CKeep the threshold the same and add more analysts to review the alerts.
   • DLower the confidence threshold for triaging alerts as high priority, and add an automated secondary filter that uses threat intelligence to suppress likely false positives.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How can an AI model be used to refine an existing detection rule?

   • ABy encrypting the rule so that only authorized analysts can view it
   • BBy automatically deploying the rule to all production systems without any testing
   • CBy analyzing historical alert data to suggest adjustments that reduce false positives while preserving true positive detections
   • DBy replacing the need for any human review of detection logic
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A SOC uses an AI model to prioritize incidents. The model was trained on historical data, but the threat landscape has changed, and the model's performance is degrading. The team wants to update the model without losing the ability to detect new threats. What is the best approach?

   • AKeep the model static and rely on manual analysis for new threats.
   • BReplace the model with a rule-based system that uses the latest threat intelligence.
   • CRetrain the model on the original historical data with more features.
   • DContinuously retrain the model with new labeled data from recent incidents, and use a feedback loop where analysts label the model's predictions to generate new training data.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A SOC has deployed an AI-based alert triage system that assigns a priority score to each alert. After three months, the team notices that analysts are spending more time on low-priority alerts that the system marked as 'critical'. What is the most appropriate first step to diagnose and improve the system's performance?

   • AReview the model's feature engineering to ensure it is using the correct data fields from the alerts.
   • BDisable the AI triage system and revert to manual triage until a new model is developed.
   • CIncrease the threshold for what the AI model considers a 'critical' alert.
   • DAnalyze the historical alerts that were scored as 'critical' but turned out to be false positives, and use this data to retrain the model.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A SOC is implementing an AI-based triage system to prioritize alerts. The system will be used to automatically assign a priority score to each alert. The SOC has a service level agreement (SLA) that requires critical alerts to be acknowledged within 5 minutes. The AI model takes an average of 30 seconds to score an alert. The SOC is concerned that the AI model's scoring time will add to the overall time to acknowledge critical alerts. What is the most effective way to address this concern?

   • AHave the AI model only score alerts that are not already identified as critical by other means.
   • BIncrease the AI model's processing speed by using a faster, but less accurate, model.
   • CChange the SLA to allow for the AI model's processing time.
   • DRun the AI model in parallel with the initial alert processing, so the alert is immediately visible to analysts while the model calculates its score.
   Reveal Solution Discussion Select an answer first