6.7 Explain AI as It Relates to Alert Analysis CYBERSECURITY-APPRENTICE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations center is implementing AI to assist with alert analysis. They want to ensure that the AI system does not become a single point of failure. What should they do?

   • ADeploy the AI system on a single server to simplify management.
   • BRely solely on the AI system and remove human analysts from the process.
   • CDisable all automated responses to avoid any risk of failure.
   • DMaintain human oversight and have a process for analysts to override AI decisions.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which machine learning technique is commonly used to identify unusual patterns in alert data that may indicate a security threat?

   • ANatural language processing
   • BRegression analysis
   • CAnomaly detection
   • DClustering
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security operations center wants to detect unusual network behavior that does not match known attack signatures. They have months of historical network traffic data and want the system to learn what is normal for their environment. Which machine learning technique is best suited for this task?

   • ASupervised classification using labeled benign and malicious traffic samples
   • BNatural language processing of threat intelligence reports
   • CAnomaly detection using unsupervised learning on historical traffic patterns
   • DRule-based correlation of known attack signatures
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a primary function of AI in automating detection and response for security alerts?

   • ATo replace the need for security policies and playbooks.
   • BTo identify patterns in alert data that indicate malicious activity and trigger predefined responses.
   • CTo manually review each alert and decide on the appropriate response.
   • DTo reduce the volume of alerts by deleting low-priority ones without any analysis.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team is using an AI-based alert triage system that automatically categorizes alerts. They notice that the system is consistently misclassifying alerts related to a new type of malware. What is the most likely reason for this?

   • AThe AI model is being deliberately attacked by the malware authors.
   • BThe AI model is too complex for the amount of data it is processing.
   • CThe AI model has not been trained on this new type of malware, so it does not recognize it.
   • DThe AI model is not receiving enough alerts to make accurate predictions.
   Reveal Solution Discussion Select an answer first