Leverage AI/ML for Automated Threat Detection and Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team deploys an unsupervised model to detect network anomalies. The model generates many alerts for a new, legitimate application that was recently deployed. What is the most likely cause of these false positives?

   • AThe model is overfitting to the training data
   • BThe model is using too many features
   • CThe model's confidence threshold is set too low
   • DThe model was trained on data that did not include the new application's traffic patterns
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security architect needs to detect new, previously unseen malware variants. The team has a large dataset of known malware and benign files. Which AI/ML approach is best suited for this task?

   • AUse a static hash-based reputation lookup for all files
   • BTrain a supervised classifier on known malware and benign samples to classify new files
   • CApply a supervised model trained only on benign files
   • DUse an unsupervised anomaly-detection model to flag files that deviate from known benign patterns
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A team is training a supervised model to detect phishing emails. They have a dataset of 10,000 emails, of which only 200 are labeled as phishing. The model achieves 99% accuracy but misses 80% of the phishing emails. What is the most likely cause of this poor detection performance?

   • AThe training dataset is imbalanced, and the model is biased toward the majority class
   • BThe model is underfitting because the features are too complex
   • CThe model is overfitting to the training data
   • DThe validation set is too large compared to the training set
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is a potential consequence of reducing false negatives in an AI/ML threat detection system?

   • AElimination of the need for human analysts
   • BImproved model training speed
   • CA decrease in the number of alerts
   • DAn increase in false positives
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization uses Splunk Enterprise Security and wants to integrate a custom AI/ML model that scores each authentication event for risk. The architect needs the risk scores to trigger SOAR playbooks for high-risk events. What is the most effective integration approach?

   • AConfigure the model to send emails directly to the security team for each high-risk score
   • BReplace the custom model with a built-in Splunk ML Toolkit algorithm that runs only on demand
   • CHave the model write risk scores to a CSV file that analysts review daily
   • DIngest the model's risk scores into Splunk as events and create a correlation search that fires a notable event for SOAR to consume
   Reveal Solution Discussion Select an answer first