An autoencoder is used to detect anomalies in network traffic. The reconstruction error distribution is heavily skewed, and the team must choose a threshold to flag anomalies. They have a small labeled set of known attacks. Which threshold selection method is most defensible?

Set the threshold to the mean reconstruction error plus two standard deviations.

Use a fixed threshold of 0.5 on the normalized reconstruction error.

Choose the threshold that maximizes F1-score on the labeled validation set.

Set the threshold at the 99th percentile of reconstruction errors on normal training data.

In anomaly detection, which technique is commonly used to address the problem of class imbalance where anomalies are extremely rare?

Using class weights or oversampling the minority class

Decreasing the number of features

Adding more hidden layers to the neural network

GIAC Machine Learning Engineer

Domain 3Objective 1

Anomaly Detection and Optimization GMLE Practice Questions (Page 10)

Part of the Advanced Machine Learning and Neural Networks domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

9concepts

Questions 46–47

46application · medium
An autoencoder is used to detect anomalies in network traffic. The reconstruction error distribution is heavily skewed, and the team must choose a threshold to flag anomalies. They have a small labeled set of known attacks. Which threshold selection method is most defensible?
Select an answer first
47foundation · easy
In anomaly detection, which technique is commonly used to address the problem of class imbalance where anomalies are extremely rare?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GMLE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMLE” is a trademark of its owner, used for identification only.

Anomaly Detection and Optimization GMLE Practice Questions (Page 10)

Questions 46–47

An autoencoder is used to detect anomalies in network traffic. The reconstruction error distribution is heavily skewed, and the team must choose a threshold to flag anomalies. They have a small labeled set of known attacks. Which threshold selection method is most defensible?

In anomaly detection, which technique is commonly used to address the problem of class imbalance where anomalies are extremely rare?

Keep studying — Advanced Machine Learning and Neural Networks