1.2 Explain the Role of AI and Machine Learning (ML) in Security Operations CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A SOC is evaluating an ML tool that detects malware by analyzing file behavior in a sandbox. The tool has a high detection rate but also a high false positive rate, flagging legitimate software as malicious. The SOC has limited analyst resources. What is the most effective way to reduce the operational burden of false positives?

   • AHire more analysts to handle the increased alert volume.
   • BDisable the tool and rely on signature-based detection.
   • CCreate a whitelist of known legitimate applications and suppress alerts for them.
   • DIncrease the tool's detection threshold to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst notices that a user who normally accesses files only during business hours has started downloading large volumes of data at 2:00 AM over several days. The behavior does not match any known signature. Which ML capability would most likely flag this activity?

   • AAnomaly detection using user behavior analytics (UBA) that establishes a baseline of normal activity.
   • BA rule that alerts when any user downloads more than 1 GB in a single day.
   • CA supervised classification model trained to identify specific malware families.
   • DA signature-based malware detection engine that matches file hashes against known threats.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A SOC is implementing an ML-based phishing detection system. The model has a very low false positive rate but also a low true positive rate, meaning it misses many phishing emails. What is the most appropriate action to improve the true positive rate without significantly increasing false positives?

   • ARetrain the model with more phishing samples to improve its ability to detect them.
   • BDisable the model and use a manual review process for all emails.
   • CAdjust the classification threshold to be more sensitive, then evaluate the impact on false positives.
   • DIncrease the false positive rate to catch more phishing emails.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which statement correctly differentiates AI from ML in the context of security operations?

   • AAI and ML are identical terms and can be used interchangeably.
   • BML is a broader concept that includes AI techniques.
   • CAI is a subset of ML that focuses on pattern recognition.
   • DAI is the broader field that encompasses ML and other techniques.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A SOC team deploys an ML model to detect network anomalies. The model was trained on data from a data center environment. They now want to use it to monitor a cloud-based environment with different traffic patterns. What is the most important consideration?

   • AThe model will be more effective in the cloud because cloud traffic is simpler.
   • BThe model will automatically adapt to the new environment because it is ML.
   • CThe model will work perfectly because it was trained on a large dataset.
   • DThe model may need to be retrained or fine-tuned on cloud-specific traffic data to maintain accuracy.
   Reveal Solution Discussion Select an answer first