1.2 Explain the Role of AI and Machine Learning (ML) in Security Operations CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which AI/ML use case involves analyzing email content and metadata to identify malicious messages?

   • ANetwork traffic analysis
   • BVulnerability scanning
   • CPhishing analysis
   • DMalware sandboxing
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst is investigating a potential malware infection. The malware is polymorphic and changes its code signature each time it infects a new host. Which AI/ML approach would be most effective at detecting this malware?

   • AImplement a firewall rule that blocks all traffic from the malware's command-and-control server IP.
   • BUse a behavioral ML model that analyzes the malware's actions, such as registry changes and network connections, rather than its static signature.
   • CUse a static analysis tool that examines the malware's binary code for known strings.
   • DRely on signature-based detection that matches the malware's file hash against a known database.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC is implementing an ML model to detect data exfiltration. The model is trained on network traffic logs. The team notices that the model frequently flags large file transfers to a legitimate cloud storage service as suspicious. How should the team address this issue?

   • AIncrease the model's sensitivity to catch more potential exfiltration attempts.
   • BDisable alerts for the specific cloud storage service.
   • CRemove all cloud storage traffic from the model's training data.
   • DIncorporate context such as user role, destination reputation, and time of day into the model's features.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to improve its phishing detection capabilities. They have a large corpus of historical emails labeled as 'phishing' or 'legitimate'. Which AI/ML approach would best leverage this data to automatically identify new phishing emails?

   • AUse an unsupervised clustering algorithm to group all emails into two clusters without using labels.
   • BDeploy a rule-based filter that blocks emails containing suspicious keywords like 'urgent' or 'password'.
   • CImplement a reputation-based system that blocks emails from known malicious sender domains.
   • DTrain a supervised ML classifier on the labeled email corpus to predict whether new emails are phishing.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes the primary role of AI in a modern SOC?

   • AAI only generates alerts and does not assist with analysis or response.
   • BAI automates repetitive detection, analysis, and response tasks, allowing analysts to focus on complex threats.
   • CAI is used solely to store security logs and manage data retention.
   • DAI replaces human analysts entirely, making manual review unnecessary.
   Reveal Solution Discussion Select an answer first