6.7 Explain AI as It Relates to Alert Analysis CYBERSECURITY-APPRENTICE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security operations center has implemented an AI-based alert triage system that automatically escalates high-risk alerts to analysts. However, the system is producing a high number of false positives, and analysts are becoming desensitized to the alerts. The team wants to maintain the benefits of automation while reducing alert fatigue. What is the best approach?

   • AIncrease the threshold for what is considered high-risk, so fewer alerts are escalated.
   • BDisable automated escalation and require analysts to review all alerts manually.
   • CRoute all alerts to a single senior analyst for final review before escalation.
   • DImplement a feedback loop where analysts mark false positives, and the model is periodically retrained with this feedback.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team wants to use AI to automatically correlate alerts from multiple sources, such as firewall logs, endpoint detection, and identity systems, to identify a coordinated attack. Which AI capability is most relevant for this task?

   • ANatural language processing to analyze log messages for keywords
   • BRule-based correlation using predefined attack scenarios
   • CMachine learning models that learn patterns of multi-stage attacks from historical data
   • DAnomaly detection to identify unusual behavior in each individual source
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How does AI contribute to faster response times in security operations?

   • ABy delaying analysis until a human analyst is available.
   • BBy requiring analysts to manually approve every response action.
   • CBy automatically analyzing alerts and initiating immediate response actions.
   • DBy increasing the number of alerts that need investigation.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team notices that their AI-based alert triage system is generating a high number of false positives, causing analysts to lose trust in the system. What is the most effective way to address this issue?

   • AIgnore the false positives and focus only on the true positives.
   • BIncrease the sensitivity of the AI model to catch more alerts.
   • CDisable the AI system and return to manual alert analysis.
   • DRetrain the AI model with more accurate and up-to-date data, and provide feedback on false positives.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is using an AI-based alert analysis system that relies on a supervised classification model. An attacker has learned the model's behavior and is crafting phishing emails that bypass the model's detection. What is the most effective way to defend against this type of attack?

   • AIncrease the model's sensitivity to catch more emails, even if it increases false positives.
   • BUse a rule-based filter to block all emails that contain suspicious keywords.
   • CDisable the AI system and rely on manual email analysis.
   • DRegularly retrain the model with new adversarial examples and update the training data.
   Reveal Solution Discussion Select an answer first