1.2 Explain the Role of AI and Machine Learning (ML) in Security Operations CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In security operations, which of the following is an example of ML, rather than general AI?

   • AA chatbot that answers user questions using a scripted decision tree.
   • BA system that uses predefined rules to block traffic from known malicious IPs.
   • CA model that is trained on historical phishing emails to identify new phishing attempts.
   • DA manual process where analysts review alerts and update signatures.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC is comparing two tools: Tool A uses a neural network to classify emails as phishing or legitimate, while Tool B uses a list of known phishing domains. Which statement accurately differentiates these tools?

   • ANeither tool uses ML because they both rely on predefined inputs.
   • BBoth tools use ML because they both make decisions automatically.
   • CTool A uses ML because it learns patterns from data, while Tool B uses a static list and is not ML.
   • DTool B uses ML because it processes data to make decisions.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is a key characteristic of machine learning models used for anomaly detection?

   • AThey are programmed with explicit rules for every possible attack.
   • BThey are static and do not adapt to new data.
   • CThey require no training data to operate.
   • DThey learn from historical data to establish a baseline of normal behavior.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A SOC team is overwhelmed by thousands of daily low-severity alerts from their SIEM. The manager wants to reduce analyst fatigue while ensuring that genuine threats are not missed. The team has a well-tagged historical dataset of confirmed incidents and benign events. Which approach should the manager implement first?

   • AAssign all low-severity alerts to a junior analyst for manual review.
   • BIncrease the SIEM threshold for all rules so that only high-severity events generate alerts.
   • CImplement a rule-based deduplication script that collapses alerts with identical source and destination IPs.
   • DDeploy an ML model trained on the historical dataset to score and prioritize alerts by likelihood of being a true positive.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a common use case for AI/ML in a SOC?

   • AUsing ML to analyze user behavior and detect anomalies that may indicate compromised accounts.
   • BReplacing the need for security information and event management (SIEM) systems.
   • CAutomating the creation of new firewall rules based on administrator preferences.
   • DEliminating the need for human analysts in the SOC.
   Reveal Solution Discussion Select an answer first