1.2 Explain the Role of AI and Machine Learning (ML) in Security Operations CLOUD-SECURITY-PROFESSIONAL Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security vendor claims their product uses 'AI' to detect threats. Upon review, the product uses a fixed set of if-then rules to block traffic from known malicious IPs. How should a SOC analyst classify this product?

   • AIt uses ML because it processes data to make decisions.
   • BIt uses AI because it automates a security decision.
   • CIt uses both AI and ML because it makes decisions faster than a human.
   • DIt uses automation, not AI or ML, because it follows static rules.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of AI-driven automation in a SOC?

   • AAn analyst manually reviews each alert and decides whether to escalate it.
   • BA playbook automatically quarantines a file when AI determines it is malicious.
   • CAn administrator updates firewall rules based on a vendor advisory.
   • DA security team meets weekly to discuss recent incidents.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A SOC is considering using AI to automate incident response. The team is concerned about the risk of the AI taking incorrect actions, such as quarantining a critical production server. What is the best approach to mitigate this risk?

   • ADisable all automated responses and rely solely on manual analysis.
   • BAllow the AI to take any action it deems necessary to respond quickly.
   • CTrain the AI only on historical incidents and never update it.
   • DImplement a human-in-the-loop (HITL) process where the AI recommends actions but a human approves them before execution.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A SOC is evaluating a new tool that uses ML to detect malware. The tool was trained on a dataset of Windows executables. The company also uses Linux servers. What is a potential limitation of this tool?

   • AThe model may not perform well on Linux executables because it was trained only on Windows samples.
   • BThe model will automatically adapt to Linux executables without additional training.
   • CThe model will slow down the Linux servers because it is not optimized for them.
   • DThe model will only detect malware that has a known signature.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC wants to automate the initial response to common alerts, such as quarantining a file or disabling a user account, to reduce response time. Which AI/ML capability would enable this?

   • AOrchestration and automation combined with ML-based decisioning to trigger predefined response actions.
   • BA manual playbook that guides analysts through the response steps.
   • CA rule-based system that automatically quarantines all files flagged by the antivirus.
   • DA standalone ML model that directly quarantines files without any external system integration.
   Reveal Solution Discussion Select an answer first