6.7 Explain AI as It Relates to Alert Analysis CYBERSECURITY-APPRENTICE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a potential drawback of relying solely on AI for alert analysis?

   • AIt eliminates the need for security monitoring tools.
   • BIt always requires more human analysts than manual analysis.
   • CIt guarantees that all threats are detected without error.
   • DIt can produce false positives that waste analyst time.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does AI help reduce noise in alert management?

   • ABy categorizing alerts and filtering out those that are likely benign or low-risk.
   • BBy requiring analysts to manually approve each alert before it is displayed.
   • CBy suppressing all alerts that are not marked as critical.
   • DBy increasing the threshold for all alerts so fewer are generated.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security team wants to automatically categorize incoming alerts into 'malware', 'phishing', 'lateral movement', and 'benign' categories. They have a large dataset of historically labeled alerts. Which machine learning approach should they use?

   • ASupervised classification using the labeled dataset to train a model
   • BAnomaly detection to flag alerts that deviate from normal behavior
   • CUnsupervised clustering to group similar alerts without predefined labels
   • DNatural language processing to read alert descriptions and extract keywords
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is considering using AI to automate response actions, such as isolating infected endpoints. However, they are concerned about the risk of the AI taking incorrect actions that could disrupt business operations. What is the best way to mitigate this risk while still benefiting from automation?

   • ADisable all automated responses and rely on manual analysis to avoid any risk.
   • BAllow the AI to take any action it deems necessary without human intervention to maximize speed.
   • CUse AI to recommend actions, but require human approval for any action that could impact critical systems.
   • DImplement AI only for detection, not for any response actions.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization is using an AI-based alert analysis system. An attacker is aware of the system and deliberately crafts malicious activity to appear normal to the AI model. What is this an example of?

   • AAn adversarial attack, where the attacker manipulates data to evade the AI's detection.
   • BA false negative, where the AI fails to detect a real threat.
   • CA model drift, where the AI's performance degrades over time due to changes in the environment.
   • DA false positive, where the AI incorrectly flags benign activity as malicious.
   Reveal Solution Discussion Select an answer first