1.2 Explain the Role of AI and Machine Learning (ML) in Security Operations CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How do machine learning models improve threat detection in a SOC?

   • AThey rely on static rules that never change.
   • BThey replace all other security tools in the SOC.
   • CThey only work with signature-based detection methods.
   • DThey identify patterns and anomalies in data to detect previously unknown threats.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key benefit of implementing AI/ML in security operations?

   • AIt requires no ongoing maintenance or tuning.
   • BIt guarantees that no false positives will occur.
   • CIt reduces the workload on analysts by automating routine tasks.
   • DIt eliminates the need for security policies.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a limitation of using AI/ML in security operations?

   • AAI/ML models can be evaded by adversaries who understand how they work.
   • BAI/ML models require no data to be effective.
   • CAI/ML models are only useful for detecting known threats.
   • DAI/ML models always produce accurate results with no errors.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A SOC manager is deciding whether to deploy an ML-based anomaly detection system. The system requires continuous retraining to adapt to changing network patterns. The team has limited ML expertise and a small budget. What is the most significant operational challenge they will face?

   • AThe need for ongoing model maintenance and retraining, which requires specialized skills and resources.
   • BThe system will require a complete replacement of the existing SIEM infrastructure.
   • CThe system will be unable to detect any threats without a constant internet connection.
   • DThe system will immediately reduce all false positives to zero.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SOC team wants to detect insider threats by identifying employees who access files outside their normal job function. They have historical access logs for all employees. Which ML technique is best suited for this task?

   • ASupervised learning to classify users as 'insider threat' or 'normal' based on a labeled dataset.
   • BUnsupervised learning to cluster user access patterns and flag outliers that deviate from the norm.
   • CA rule-based system that alerts when a user accesses files outside their department's shared folder.
   • DA signature-based detection system that matches access patterns against known insider threat signatures.
   Reveal Solution Discussion Select an answer first