Anomaly Detection and Optimization GMLE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security operations team monitors authentication logs for compromised accounts. They have a labeled dataset of past attacks and normal behavior, but the attack class represents only 0.5% of the records. They need to maximize the number of true attacks caught while keeping the false positive rate manageable for the triage team. Which approach best meets this requirement?

   • ATrain a one-class SVM on normal data only and treat any deviation as an attack.
   • BTrain an isolation forest on all data and flag the top 1% of instances with the lowest anomaly scores.
   • CTrain a supervised classifier on the labeled data and tune the decision threshold to target a high recall for the attack class.
   • DUse a Gaussian mixture model and flag instances with a posterior probability below 0.01.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which type of anomaly detection problem is best suited for identifying a sudden spike in network traffic that is only anomalous when compared to the traffic pattern of the same hour on previous days?

   • ACollective anomaly detection
   • BContextual anomaly detection
   • CUnsupervised clustering
   • DPoint anomaly detection
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In anomaly detection, which metric is most appropriate when the cost of missing an anomaly (false negative) is much higher than the cost of a false positive?

   • AAccuracy
   • BPrecision
   • CF1-score
   • DRecall
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A fraud detection team has a model that flags suspicious transactions. The model is deployed, but the fraud investigators are overwhelmed because the model flags 10% of all transactions, while only 0.1% of transactions are actually fraudulent. The team wants to reduce the number of false positives while still catching most fraud. Which metric should they optimize to directly reflect the investigators' workload?

   • AMaximize ROC-AUC, which summarizes the trade-off between true positive rate and false positive rate.
   • BMaximize F1-score, which balances precision and recall equally.
   • CMaximize recall, ensuring that all fraudulent transactions are flagged.
   • DMaximize precision, ensuring that a higher proportion of flagged transactions are truly fraudulent.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A neural network training run is oscillating: the loss decreases then increases repeatedly, and the model never converges. The learning rate is currently 0.1. Which adjustment is most likely to stabilize training?

   • ASwitch to a larger batch size
   • BIncrease the learning rate to 0.5
   • CAdd momentum with a high value
   • DDecrease the learning rate to 0.01
   Reveal Solution Discussion Select an answer first