Comprehend Artificial Intelligence (AI)/Machine Learning (ML) CCSP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A security team uses an AI/ML model to detect phishing emails. The model is trained on a dataset of emails labeled as 'phishing' or 'legitimate'. An attacker has been submitting carefully crafted emails to the system's feedback loop, causing the model to gradually misclassify phishing emails as legitimate. The team needs to prevent this type of model poisoning. Which measure is most effective?

   • AIncrease the model's complexity to make it harder for attackers to influence.
   • BImplement a human review process for all feedback before it is used for retraining.
   • CUse a larger training dataset to dilute the impact of malicious samples.
   • DRegularly retrain the model with the latest email samples.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security operations team uses an AI/ML-based alert correlation system that integrates with a SOAR platform. The system generates a high volume of alerts, and the SOAR platform automatically responds to all of them, including low-severity ones. This has led to unnecessary actions, such as isolating non-malicious VMs, and has caused operational disruption. The team wants to reduce the impact of automated responses while maintaining efficient incident handling. Which approach best achieves this?

   • ADisable the SOAR platform and handle all alerts manually to avoid disruptions.
   • BHave the SOAR platform automatically respond to all alerts but with a delay to allow human review.
   • CIncrease the AI/ML model's sensitivity to ensure all potential threats are caught.
   • DConfigure the SOAR platform to only execute automated responses for alerts with a high confidence score from the AI/ML system.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company uses an AI/ML-based threat detection system that sends alerts to a SOAR platform. The SOAR platform is configured to automatically block IP addresses that are flagged as malicious by the AI/ML system. However, the AI/ML system has a known false positive rate, and blocking legitimate IP addresses has caused service disruptions. The security team wants to reduce the risk of blocking legitimate traffic while maintaining automated response capabilities. Which approach is most appropriate?

   • ASet a threshold for the AI/ML system's confidence score, and only automate blocking for high-confidence alerts.
   • BDisable the automated blocking feature and rely on manual response.
   • CIncrease the AI/ML system's sensitivity to catch more threats, even if it increases false positives.
   • DConfigure the SOAR platform to require human approval before blocking any IP address.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which ethical concern is most directly related to AI/ML models making decisions that affect individuals differently based on protected characteristics?

   • APrivacy
   • BAccountability
   • CTransparency
   • DBias
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of Security Orchestration, Automation and Response (SOAR) in cloud security?

   • ATo store security logs for compliance
   • BTo replace all human security analysts
   • CTo automate and streamline incident response workflows
   • DTo provide a graphical interface for configuring firewalls
   Reveal Solution Discussion Select an answer first