Malware and AI Assisted Investigations GCIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's SOC uses an AI-based email gateway that flags phishing emails with a confidence score. During a simulated phishing test, the gateway flagged a legitimate internal email as 'phishing' with a high confidence score. What is the best way to handle this situation?

   • ADisable the AI gateway permanently
   • BImmediately block all emails with high confidence scores
   • CReview the AI model's features and adjust the threshold or retrain the model
   • DIgnore the false positive because AI is always correct
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary benefit of combining AI-driven insights with manual analysis in malware investigations?

   • AElimination of false positives
   • BImproved accuracy and efficiency
   • CGuaranteed identification of malware authors
   • DRemoval of the need for malware analysis tools
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is investigating a suspicious PowerShell script that evaded traditional antivirus. The analyst uses an AI-based tool that flags the script as malicious based on obfuscation patterns. To confirm the finding, the analyst decides to manually review the script. Which manual review step is most effective?

   • ASearch the script's hash on VirusTotal.
   • BRun the script in a sandbox and observe its network activity.
   • CCheck the script's file size and creation date.
   • DDecode the obfuscated script and examine the underlying commands.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) receives an alert from an AI-based endpoint detection tool about a PowerShell script that exhibits obfuscated code and attempts to download a file from a rarely visited domain. The AI model flagged it as 'high confidence malware'. The analyst needs to validate the alert before escalating. Which action best combines AI insights with traditional analysis?

   • AReview the script's code, check the domain reputation, and run the script in a sandbox
   • BImmediately escalate the alert to the incident response team
   • CDisable the AI model to prevent false positives
   • DQuarantine the file based solely on the AI confidence score
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst is investigating a file that an AI tool flagged as malware. The analyst's manual static analysis shows the file is a legitimate installer from a known vendor. What should the analyst do?

   • ATrust the AI tool and quarantine the file.
   • BAsk the AI tool to re-evaluate the file with different parameters.
   • COverride the AI tool's finding based on the manual analysis and document the false positive.
   • DRun the file in a sandbox to see if it behaves maliciously.
   Reveal Solution Discussion Select an answer first