Leverage AI/ML for Automated Threat Detection and Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team deploys an AI/ML model to detect insider threats. After three months, the model's performance degrades because user behavior patterns have changed. The architect needs to ensure the model remains effective over time. Which process should the architect establish?

   • ARetrain the model quarterly using only the most recent month of data
   • BManually update the model's thresholds each week based on intuition
   • CKeep the original model frozen to maintain consistent detection criteria
   • DSchedule periodic retraining with new labeled data and incorporate feedback from analysts on model predictions
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary benefit of integrating AI/ML models with a SOAR platform?

   • AIt automatically patches all vulnerabilities in the network
   • BIt enables automated decision-making and response orchestration based on AI/ML insights
   • CIt eliminates the need for any human oversight in security operations
   • DIt replaces the SIEM system entirely
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security team wants to detect anomalous outbound data transfers that could indicate data exfiltration. They have no historical labels for exfiltration events, but they have months of NetFlow data. They need a model that flags deviations from normal traffic patterns. Which approach should the architect recommend?

   • AApply an unsupervised clustering or anomaly-detection model to baseline normal behavior and flag outliers
   • BManually write static threshold rules for outbound byte counts per host
   • CTrain a supervised classifier using labeled exfiltration and benign traffic samples
   • DUse a pre-trained supervised model from a vendor without retraining on local data
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A team wants to build a model that predicts which endpoints are likely to be compromised based on historical incident data. They have a dataset with features like OS version, patch level, and user behavior. Which approach should they use?

   • AReinforcement learning to optimize response actions
   • BSupervised classification using historical compromise labels as the target variable
   • CUnsupervised clustering to group endpoints without using labels
   • DTime-series forecasting to predict future incidents
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security team deploys an AI/ML model to detect lateral movement. Analysts mark 90% of the model's alerts as false positives. The architect needs to improve the model's precision without significantly increasing false negatives. Which action is most effective?

   • ASuppress alerts from the model and rely on manual detection
   • BIncrease the alert threshold to reduce the number of alerts
   • CAdd more features to the model to capture more context
   • DRetrain the model using the analyst feedback as new labeled data
   Reveal Solution Discussion Select an answer first