6.7 Explain AI as It Relates to Alert Analysis CYBERSECURITY-APPRENTICE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team wants to deploy an AI model to detect insider threats. They have a large dataset of user activity logs, but very few examples of actual insider threat incidents. They need a model that can identify unusual behavior without relying on scarce labeled examples. Which approach is most appropriate?

   • AUnsupervised anomaly detection to identify deviations from normal user behavior
   • BNatural language processing of user emails to detect malicious intent
   • CSupervised classification trained on the few labeled insider threat incidents
   • DRule-based detection using predefined insider threat indicators
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security operations center is considering implementing AI to assist with alert analysis. They have a limited budget and need to justify the investment to management. Which benefit of AI should they emphasize to make the strongest case?

   • AAI can reduce the mean time to detect and respond to threats by automating initial analysis and prioritization.
   • BAI can automatically patch all vulnerabilities without human intervention.
   • CAI can completely eliminate the need for security analysts, reducing labor costs.
   • DAI can guarantee that no security breach will occur.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team has deployed an AI-based alert triage system that automatically closes low-risk alerts. After a few weeks, they notice that some genuine phishing emails are being closed without analyst review. What is the most likely cause of this issue?

   • AThe AI is prioritizing speed over accuracy, which is a known trade-off.
   • BThe team has disabled all human oversight, which is required for every alert.
   • CThe AI model is not being retrained on new phishing patterns, so it fails to recognize them as high-risk.
   • DThe system is generating too many alerts, overwhelming the AI model.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a key benefit of using AI in alert analysis?

   • AIt increases the number of alerts that need manual review.
   • BIt eliminates the need for security policies.
   • CIt guarantees that no false positives will occur.
   • DIt reduces the workload on human analysts by automating routine tasks.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is human oversight still necessary when AI is used for alert analysis?

   • ABecause AI always produces incorrect results.
   • BBecause AI may be vulnerable to adversarial attacks that manipulate its decisions.
   • CBecause AI cannot process large volumes of alerts.
   • DBecause AI systems cannot be trusted at all.
   Reveal Solution Discussion Select an answer first