Leverage AI/ML for Automated Threat Detection and Response. CYBERSECURITY-DEFENSE-ARCHITECT Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   A Splunk SOAR playbook receives an alert from an AI/ML model that detects a potential credential-stuffing attack. The architect needs to ensure the playbook automatically blocks the source IP but only after confirming the alert is not a false positive. Which design should the architect implement?

   • ABlock the IP and disable the AI/ML model if the alert is later found to be a false positive
   • BSend the alert to a human analyst for manual review before any automated action
   • CRun an enrichment and validation step first, then conditionally trigger the IP block action
   • DImmediately block the IP and then run an investigation playbook in parallel
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a SOAR platform, what is the typical role of an AI/ML model's output?

   • AIt directly modifies firewall rules without any human or workflow approval
   • BIt replaces the need for threat intelligence feeds
   • CIt serves as a trigger or enrichment for automated incident response playbooks
   • DIt stores all security logs in a central repository
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is it important to continuously update AI/ML models used for threat detection?

   • ATo reduce the amount of data stored in the SIEM
   • BTo eliminate the need for security analysts
   • CTo ensure the model always produces the same output for the same input
   • DTo adapt to evolving threats and changes in the environment that may affect model accuracy
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In the context of AI/ML for threat detection, what is the primary difference between supervised and unsupervised learning?

   • ASupervised learning is used for anomaly detection, while unsupervised learning is used for classification.
   • BSupervised learning does not require human input, while unsupervised learning requires labeled data.
   • CSupervised learning requires labeled training data, while unsupervised learning identifies patterns in unlabeled data.
   • DSupervised learning is only used for regression, while unsupervised learning is only used for clustering.
   Reveal Solution Discussion Select an answer first