6.7 Explain AI as It Relates to Alert Analysis CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company wants to reduce the time between when a security alert is generated and when it is contained. They have a small team that works only during business hours. Which AI capability would most directly help achieve this goal?

   • AA ticketing system that assigns alerts to analysts based on their current workload
   • BAutomated response playbooks that can isolate affected endpoints immediately upon high-confidence detection
   • CA dashboard that visualizes all alerts in real time for the team to review
   • DA machine learning model that predicts future attacks based on historical data
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary use of classification models in alert analysis?

   • ATo predict the exact time of a future attack.
   • BTo reduce the storage size of alert logs.
   • CTo categorize alerts as either malicious or benign based on learned features.
   • DTo generate new alerts from raw network traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team wants to use AI to automatically enrich alerts with contextual information, such as threat intelligence and asset criticality, to help analysts make faster decisions. What is the primary benefit of this approach?

   • AIt eliminates the need for threat intelligence feeds.
   • BIt reduces the number of alerts generated by the system.
   • CIt automatically resolves all alerts without human intervention.
   • DIt provides analysts with additional context, allowing them to prioritize and respond to alerts more effectively.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the main purpose of AI-driven alert triage?

   • ATo prioritize and categorize alerts so analysts focus on the most critical threats.
   • BTo replace the need for security monitoring tools.
   • CTo generate more alerts for analysts to review.
   • DTo store alerts in a separate database for compliance purposes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is evaluating an AI-based alert triage tool. They want to ensure that high-priority alerts are not missed due to the tool's automation. What should they configure to maintain human oversight?

   • ASet the tool to automatically close all low-risk alerts without any review.
   • BRequire analyst approval for any automated action taken on high-priority alerts.
   • CDisable all automated responses and rely solely on manual analysis.
   • DIncrease the alert volume so that analysts can review every alert manually.
   Reveal Solution Discussion Select an answer first