Leverage AI/ML for Automated Threat Detection and Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A data science team trains a model to detect malicious PowerShell commands. They split their data into 80% training and 20% test sets. The model performs well on the test set but poorly on live data. Which validation mistake is most likely?

   • AThe test set contains data from the same time period as the training set, causing temporal leakage
   • BThe model was trained for too many epochs, causing overfitting to the training set
   • CThe test set is too small to provide reliable performance metrics
   • DThe training set contains too many benign examples
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of an automated threat response workflow triggered by an AI/ML detection output?

   • ATo replace the need for human security analysts entirely
   • BTo execute predefined actions quickly and consistently in response to a detected threat
   • CTo generate a report of all detected threats for compliance purposes only
   • DTo train the AI/ML model on new data in real-time
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Splunk SOAR playbook is triggered by an AI/ML model alert. The playbook's first action is to query an external threat-intelligence service. The query times out, causing the playbook to fail. What is the best way to make the playbook more resilient?

   • AConfigure the playbook to fail silently and log the error
   • BIncrease the timeout value to 30 minutes
   • CAdd error handling and a retry mechanism for the threat-intel query
   • DRemove the threat-intel query from the playbook entirely
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a common strategy to reduce false positives in an AI/ML-based threat detection system?

   • ADisabling all automated response actions
   • BUsing only supervised learning models
   • CAdjusting the detection threshold to require a higher confidence score before raising an alert
   • DIncreasing the number of alerts generated by the system
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A model that detects malicious URLs is trained on a dataset collected last year. The model's performance has declined because attackers now use shorter-lived domains. The architect needs to update the model. Which approach is most effective?

   • AIncrease the model's confidence threshold to reduce false positives
   • BRetrain the model with recent URL data that reflects current attacker behavior
   • CKeep the original model and add a static blocklist for known malicious domains
   • DUse the same training data but train for more epochs
   Reveal Solution Discussion Select an answer first