
GIAC Machine Learning Engineer
Domain 3Objective 1
Anomaly Detection and Optimization GMLE Practice Questions (Page 7)
Part of the Advanced Machine Learning and Neural Networks domain, which makes up ~30% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~21–36 in this domain), expect 7–12 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)
47questions here
10free pages
9concepts
Questions 31–35
- 31
A deep learning model for time-series forecasting shows high accuracy on training data but poor accuracy on validation data. The team suspects overfitting. Which combination of techniques is most appropriate to reduce overfitting while maintaining model capacity?
Select an answer first - 32
A financial institution is deploying an anomaly detection model to flag suspicious transactions. The model is an isolation forest trained on historical transaction data. The institution has a regulatory requirement to catch at least 95% of fraudulent transactions, but the fraud investigators can only review 500 alerts per day. The model currently achieves 90% recall with 500 alerts per day. Which action should the team take?
Select an answer first - 33
A team is deploying an anomaly detection system for industrial equipment. The cost of a missed failure is extremely high, but the maintenance team can only investigate a limited number of alerts per day. The model's ROC-AUC is 0.95, but at the current threshold, precision is 40% and recall is 90%. The team wants to reduce the number of false positives without significantly reducing the number of true positives caught. Which action is most appropriate?
Select an answer first - 34
In a fraud detection system where the model outputs a risk score for each transaction, which metric is most useful when the investigation team can only review the top 100 flagged transactions per day?
Select an answer first - 35
A machine learning team is optimizing an autoencoder for anomaly detection on high-dimensional sensor data. They have a limited budget of 100 training runs. The hyperparameters include the number of hidden layers, the size of the bottleneck layer, the learning rate, and the regularization strength. The team wants to find the best configuration for detecting rare anomalies. Which optimization strategy is most appropriate?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GMLE” is a trademark of its owner, used for identification only.