AI-assisted Security
Free CompTIA SecAI+ (CY0-001) practice — 6 questions on AI-assisted Security, with explanations. No sign-up. Full 12-question mixed test →
A security operations center is evaluating AI-powered SIEM solutions to reduce alert fatigue. The SOC processes 50,000 events per second, experiences 3,000 daily alerts with a 92% false positive rate, and requires correlation across 45 different log sources. The solution must provide explainable decisions for compliance audits. Which approach BEST addresses these requirements?
Hybrid supervised/unsupervised ML addresses both known threats (reducing false positives through learned patterns) and novel threats (zero-day detection). XAI frameworks like SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) provide the required auditability and explainability for compliance, showing which features contributed to each decision.
During a purple team exercise, an AI-powered EDR solution flagged a credential dumping attempt using a novel obfuscation technique not seen in training data. The model assigned a confidence score of 0.67 (threshold: 0.75) and did not trigger an alert. Post-incident analysis revealed the attack succeeded. What is the PRIMARY model limitation demonstrated here?
The 0.67 score indicates the model recognized suspicious activity but was intentionally evaded. Adversarial evasion exploits knowledge of decision boundaries—attackers craft payloads to score just below thresholds. The 'novel obfuscation technique' suggests deliberate adversarial manipulation to induce concept drift (shifting attack characteristics to avoid detection), which is distinct from simply being unknown to the model.
A financial institution is implementing AI-driven behavioral analytics for insider threat detection. The system analyzes file access patterns, email metadata, and login times across 12,000 employees. After deployment, the model flags 15% of the HR department during annual performance review season. Which bias mitigation strategy should be applied FIRST?
The root cause is legitimate cyclical behavior (performance reviews) being misclassified as anomalous. Temporal context awareness addresses this by encoding business cycles, scheduled events, and time-based patterns into features. This allows the model to distinguish between 'abnormal for typical day' versus 'normal for annual review period'—fixing the contextual blindness causing the false positives.
A cloud security team deploys a generative AI assistant to automatically draft incident response playbooks based on MITRE ATT&CK techniques. During testing, the AI generates a playbook for T1566.001 (Spearphishing Attachment) that recommends immediately blocking all email attachments containing macros enterprise-wide. What is the PRIMARY AI security risk demonstrated?
This is a textbook model hallucination—the AI generated a technically plausible security control (blocking macro attachments does prevent spearphishing) but lacks contextual understanding that blanket blocking would disrupt legitimate business operations (finance, procurement, etc. often use macro-enabled spreadsheets). Generative models produce fluent, confident-sounding outputs without reasoning about operational consequences or proportionality.
A penetration testing team uses an AI-powered fuzzing tool that generates 2 million test cases per hour against a REST API. The tool identifies a critical authentication bypass, but the vulnerability only manifests when three specific headers are combined in a precise sequence that appears in 0.003% of generated tests. What ML technique MOST likely enabled this discovery?
Reinforcement learning with reward shaping is specifically designed for sequential decision problems where the goal is to discover rare but high-value outcomes. The fuzzer receives rewards for auth failures, error codes, or unexpected responses, learning to combine headers in sequences that maximize these signals. This guides exploration toward the 0.003% edge case without exhaustively testing all combinations—exactly what's needed for discovering complex multi-step vulnerabilities.
An organization deploys a federated learning system across 25 subsidiaries to train a malware classification model without centralizing data. After 50 training rounds, the global model achieves 94% accuracy, but one subsidiary reports only 73% accuracy on their local data despite contributing gradients normally. What is the MOST likely cause?
Federated learning's primary challenge is non-IID data—each subsidiary faces different malware types based on industry, geography, or attackers. The global model averages gradients from all participants, optimizing for the majority distribution. If one subsidiary has unique threats (e.g., region-specific ransomware), the global model performs poorly on their data because those patterns are diluted across 25 participants. The subsidiary 'contributes normally' but their unique patterns don't dominate the global update.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through August 23.
Get my $34.99 deal →