Leverage AI/ML for Automated Threat Detection and Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An AI/ML model detects ransomware activity and triggers an automated SOAR playbook that isolates the affected host. The model has a high false-positive rate, causing legitimate user workstations to be isolated. Which strategy should the architect implement to reduce the impact of false positives?

   • ADisable the model and rely on static signature-based detection
   • BIncrease the model's confidence threshold so only high-confidence alerts trigger the playbook
   • CKeep the threshold the same but add a delay before the isolation action runs
   • DRemove the automated isolation action and require manual approval for every alert
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to use relevant security data when training an AI/ML model for threat detection?

   • ATo eliminate the need for model validation
   • BTo guarantee the model will have zero false positives
   • CTo ensure the model learns patterns that are representative of the actual environment and threats
   • DTo reduce the amount of data needed for training
   Reveal Solution Discussion Select an answer first
4. 8expert · medium

   An AI/ML model detects a potential data-exfiltration event. The automated SOAR playbook is configured to quarantine the user's account. The model has a 5% false-positive rate. The security team is concerned about locking out legitimate users. Which approach best balances automation and risk?

   • AQuarantine the account immediately and rely on the help desk to restore access if the alert is a false positive
   • BUse a lower-impact action, such as requiring multi-factor authentication (MFA) re-authentication, before escalating to quarantine
   • CDisable the automated response and only generate a report for weekly review
   • DRequire a human analyst to approve the quarantine action for every alert
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A SOAR playbook is triggered by an AI/ML alert for a possible brute-force attack. The playbook needs to gather additional context before deciding whether to block the source IP. Which sequence of actions should the playbook perform?

   • AEnrich the alert with threat-intel and user data, then conditionally block the IP
   • BSend the alert to a ticketing system without any automated action
   • CGather context and block the IP simultaneously
   • DBlock the IP first, then gather context for the incident report
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of validating an AI/ML model after training?

   • ATo label the training data for supervised learning
   • BTo increase the model's training accuracy to 100%
   • CTo convert the model into a production-ready API
   • DTo assess the model's performance on unseen data and ensure it generalizes well
   Reveal Solution Discussion Select an answer first