Leverage AI/ML for Automated Threat Detection and Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization uses Splunk SOAR and wants to automate response to AI/ML-generated alerts. The architect needs to ensure that alerts from the model are automatically converted into SOAR incidents. What is the standard method to achieve this?

   • AUse the Splunk SOAR REST API to create incidents from the model's output
   • BHave analysts manually create incidents from the model's dashboard
   • CExport the model's alerts to a CSV file and import it into SOAR daily
   • DConfigure the model to send an email to the SOAR platform's inbox
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In an automated threat response workflow, what is the role of a 'playbook'?

   • AIt defines the sequence of actions and decision points to execute when a specific alert is triggered
   • BIt provides a user interface for analysts to manually review alerts
   • CIt stores the raw logs and telemetry data used by the AI/ML model
   • DIt lists all known malware signatures for comparison
   Reveal Solution Discussion Select an answer first
4. 23expert · medium

   A model detecting malicious logins is deployed. The security team wants to implement a feedback loop to improve the model. Analysts currently mark alerts as true or false positive in the SOAR platform. Which process best uses this feedback?

   • AUse the feedback only to adjust the alert severity in SOAR
   • BPeriodically export the analyst feedback and use it as labeled data for retraining the model
   • CManually adjust the model's thresholds based on the feedback
   • DStore the feedback in a log for auditing purposes only
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a key source of feedback for improving an AI/ML model's performance over time?

   • AAnalyst validation of alerts, including confirming true positives and false positives
   • BThe model's training time
   • CThe version of the SOAR platform
   • DThe number of servers in the data center
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which AI/ML approach is most suitable for detecting previously unknown threats that do not match any known attack signature?

   • ANatural language processing to parse threat intelligence reports
   • BSupervised classification using a labeled dataset of known malware families
   • CUnsupervised anomaly detection that identifies deviations from established baseline behavior
   • DReinforcement learning that optimizes response actions based on rewards
   Reveal Solution Discussion Select an answer first