Implement Security Analytics Strategies Beyond Traditional SIEM Such as Advanced Techniques Like Data Science, Machine Learning, Behavioral Analysis, and AI. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of establishing a behavioral baseline for a user in security analytics?

   • ATo create a profile of normal activity so that deviations can be detected as potential security incidents
   • BTo store user activity logs in a separate database for compliance purposes
   • CTo encrypt all user communications to protect data in transit
   • DTo define a set of rules that block all actions not explicitly allowed
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A managed security service provider (MSSP) uses Splunk to monitor multiple clients. They want to use AI to automate the initial triage of alerts, grouping similar alerts into incidents and suggesting likely root causes. The goal is to reduce the time analysts spend on repetitive tasks. Which AI capability is most directly applicable?

   • AConfigure a correlation rule that automatically closes all alerts that contain the word 'test'.
   • BUse a regression model to predict the total number of alerts expected each day and alert the SOC manager if the count exceeds a threshold.
   • CDeploy an AI model that directly blocks the source IP of any alert that scores above a 0.9 confidence of being malicious.
   • DUse an AI model that clusters similar alerts based on text and metadata, then applies a classification model to suggest an incident type for each cluster.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In the context of security data management, which statement best describes the purpose of applying statistical modeling to security data?

   • ATo replace all existing correlation rules with automated response actions
   • BTo permanently store all raw security logs in a compressed format for compliance
   • CTo establish a baseline of normal behavior and identify statistically significant deviations that may indicate threats
   • DTo encrypt security data at rest and in transit to meet regulatory requirements
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security analyst wants to use predictive analytics to forecast which systems are most likely to be compromised in the next month. Which approach aligns with this goal?

   • AReviewing daily logs to identify and manually patch systems that were attacked yesterday
   • BAnalyzing historical attack patterns and system vulnerabilities to build a model that estimates future risk scores
   • CDeploying an antivirus solution to scan files and remove known malware signatures
   • DConfiguring a firewall to block all inbound traffic from unknown IP addresses
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst wants to detect a new phishing campaign that uses URLs with a high number of subdirectories and unusual character entropy. The analyst has a large dataset of known phishing and benign URLs. Which machine learning approach would be most effective for classifying new URLs as phishing or benign?

   • AUse a clustering algorithm to group URLs by domain name and alert on any URL in a cluster with fewer than 10 members.
   • BApply a regression model to predict the number of characters in a URL and flag URLs that are longer than average.
   • CExtract features such as URL length, character entropy, and number of subdirectories, then train a classification model on the labeled dataset.
   • DCreate a correlation rule that flags any URL with more than 5 subdirectories, without using the labeled dataset.
   Reveal Solution Discussion Select an answer first