1.4 Differentiate Between AI and Machine Learning (ML) in Security Operations SECURITY-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to implement a system that can classify network traffic as malicious or benign. They have a large dataset of labeled traffic samples. Which approach is most suitable?

   • AUse natural language processing to analyze packet payloads.
   • BUse an unsupervised learning algorithm to cluster traffic.
   • CTrain a supervised machine learning model on the labeled dataset.
   • DCreate a rule-based system that inspects packet headers.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A SOC manager wants to automate the initial triage of security alerts. The team has a well-documented playbook for common alert types, but the playbook is updated frequently as new threats emerge. The manager wants the system to follow the playbook but also learn from past triage decisions to improve accuracy. Which solution best meets this need?

   • AImplement an expert system that uses the playbook rules and periodically update it manually.
   • BUse a natural language processing tool to read the playbook and generate responses.
   • CCombine an expert system for playbook execution with a machine learning model that refines recommendations based on outcomes.
   • DUse a machine learning model to classify alerts and recommend actions, ignoring the playbook.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which AI capability is commonly used to process unstructured threat intelligence reports?

   • ASignature-based detection
   • BNatural language processing (NLP)
   • CNetwork segmentation
   • DData encryption
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security operations center (SOC) receives thousands of threat intelligence reports daily. Analysts want a system that can read these reports, extract relevant indicators of compromise (IOCs), and suggest response actions based on established knowledge. Which AI capability is most directly applicable?

   • APredictive modeling to forecast future attack trends.
   • BAnomaly detection to identify unusual report formats.
   • CMachine learning clustering to group similar reports by topic.
   • DNatural language processing to parse reports and extract IOCs.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of AI being used to simulate human intelligence in security operations?

   • AA system that calculates the average CPU usage of servers to detect potential overload.
   • BA system that encrypts data at rest to protect it from unauthorized access.
   • CA system that automatically correlates alerts from multiple sources and recommends a response based on context.
   • DA system that uses a static list of known malicious IP addresses to block traffic.
   Reveal Solution Discussion Select an answer first