Anomaly Detection and Optimization GMLE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A cybersecurity team monitors network traffic for a large enterprise. They have millions of unlabeled network flows daily, and they need to flag suspicious activity for manual review. The SOC analysts can only investigate about 50 alerts per day, so the model must prioritize the most likely anomalies. They have no historical labels for attacks. Which approach best fits their constraints?

   • AUse a Gaussian mixture model and flag all flows in the component with the lowest mixing weight as anomalies.
   • BTrain an isolation forest on the unlabeled flows and rank alerts by anomaly score, reviewing the top 50 each day.
   • CTrain a supervised gradient-boosted classifier on all flows, using the absence of confirmed attacks as the negative class.
   • DApply a one-class SVM with a linear kernel and classify any flow with a decision function below zero as an alert.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common objective function used for regression problems?

   • AMean squared error (MSE)
   • BHinge loss
   • CBinary cross-entropy
   • DCross-entropy loss
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In anomaly detection, which type of anomaly is characterized by an individual data point being unusual relative to its local neighborhood or context, even if the value itself is within the normal global range?

   • ACollective anomaly
   • BGlobal outlier
   • CPoint anomaly
   • DContextual anomaly
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the context of machine learning, what is the primary role of an objective function?

   • ATo determine the learning rate for gradient descent
   • BTo define the architecture of the neural network
   • CTo select which features to use in the model
   • DTo measure how well the model performs on the training data and guide the optimization process
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A data science team is evaluating two anomaly detection models for a fraud detection system. Model A has a ROC-AUC of 0.95, and Model B has a ROC-AUC of 0.90. However, the fraud investigators are only interested in the top 100 alerts per day, and they find that Model B catches more true fraud in the top 100 alerts than Model A. Which metric should the team use to select the model?

   • ARecall, because the team wants to catch as much fraud as possible.
   • BROC-AUC, because it is the standard metric for model comparison.
   • CPrecision-at-k, which measures the precision of the top k alerts.
   • DF1-score, which balances precision and recall.
   Reveal Solution Discussion Select an answer first