Anomaly Detection and Optimization GMLE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary difference between stochastic gradient descent (SGD) and batch gradient descent?

   • ASGD is only used for neural networks, while batch gradient descent is used for linear models
   • BSGD always converges to the global minimum, while batch gradient descent may get stuck in local minima
   • CSGD uses a fixed learning rate, while batch gradient descent adapts the learning rate
   • DSGD uses a subset of the data (a mini-batch) or a single sample to compute the gradient, while batch gradient descent uses the entire dataset
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a key characteristic of the isolation forest algorithm for anomaly detection?

   • AIt isolates anomalies by randomly partitioning the data and measuring how few splits are needed to separate a point
   • BIt requires labeled anomalies to train a binary classifier
   • CIt uses a neural network to reconstruct input data and measures reconstruction error
   • DIt builds a density model of the normal data and flags points in low-density regions
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A team is tuning an isolation forest for fraud detection. They have a large dataset and limited compute budget. They need to find a good combination of n_estimators, max_samples, and contamination. Which hyperparameter search strategy is most appropriate given the constraints?

   • ABayesian optimization with a Gaussian process surrogate.
   • BGrid search over a coarse grid of all three parameters.
   • CRandom search with a fixed number of iterations.
   • DManual tuning based on domain knowledge.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security team is building an anomaly detection system for user behavior. They have a large dataset of normal user sessions, but they do not have any labeled attacks. They want to detect unusual behavior that could indicate a compromised account. Which approach is most appropriate?

   • ATrain a supervised classifier on the normal sessions, labeling them as 'normal' and treating all other sessions as 'attack'.
   • BTrain a Gaussian mixture model with two components, assuming one component represents normal behavior and the other represents attacks.
   • CUse a z-score on each feature independently, flagging sessions where any feature is more than 3 standard deviations from the mean.
   • DTrain a one-class SVM on the normal sessions, using it to identify sessions that are different from the normal profile.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A data analyst is monitoring the number of daily logins to a corporate system. The data is normally distributed with a mean of 10,000 and a standard deviation of 500. On a particular day, the analyst observes 11,500 logins. The analyst wants to determine if this is a statistically significant anomaly. Which test is most appropriate?

   • AGaussian mixture model, fitting two components to the data and checking which component the point belongs to.
   • BGrubbs' test, to detect if the maximum value is an outlier in a univariate dataset.
   • CZ-score, calculating (11500 - 10000) / 500 = 3, and comparing it to a threshold.
   • DIsolation forest, to isolate the point based on random splits.
   Reveal Solution Discussion Select an answer first