Basic AI Concepts Related to Cybersecurity
Free CompTIA SecAI+ (CY0-001) practice — 6 questions on Basic AI Concepts Related to Cybersecurity, with explanations. No sign-up. Full 12-question mixed test →
A cybersecurity team is evaluating AI models for detecting zero-day malware. They need a model that can identify malicious patterns it has never explicitly seen during training by learning the underlying structure of malware behavior rather than memorizing specific signatures. The solution must generalize well to novel attack variants. Which machine learning approach BEST meets these requirements?
Unsupervised anomaly detection learns normal baseline behavior without requiring labeled malware samples, enabling it to flag novel deviations that represent zero-day threats. This approach generalizes to unknown attack patterns by detecting statistical anomalies rather than matching known signatures.
During a threat hunt, analysts discover that their ML-based phishing detector incorrectly classified 15% of legitimate executive emails as phishing (false positives) while missing 8% of actual phishing attempts (false negatives). The business priority is maintaining executive communication flow. What metric should be optimized and what is the resulting tradeoff?
Precision measures the proportion of phishing predictions that are actually phishing (reduces false positives). Given the business priority of maintaining executive communication, reducing false positives is critical. The explicit tradeoff is that improving precision typically decreases recall, allowing more actual phishing emails through (higher false negatives).
A financial institution uses a neural network-based fraud detection system that achieved 94% accuracy during testing but only 78% accuracy in production after six months. Investigation reveals that attackers have adapted their techniques to evade detection. What phenomenon explains this degradation and what is the appropriate remediation?
Concept drift occurs when the statistical properties of the target variable (fraud patterns) change over time, causing model performance degradation. In adversarial environments like fraud detection, attackers continuously evolve tactics. Continuous retraining with recent data allows the model to adapt to evolving attack patterns.
An organization deploys a large language model (LLM) to assist SOC analysts with incident triage. During testing, analysts notice the model occasionally generates plausible-sounding but factually incorrect remediation steps, including referencing non-existent CVE identifiers and fabricated patch commands. What AI risk does this represent and what mitigation is MOST effective?
Hallucination is when LLMs generate confident but factually incorrect information, including fabricated CVEs and commands. RAG grounds the model's responses in verified external knowledge bases, forcing it to retrieve and cite actual documented information rather than generating plausible-sounding fabrications from pattern matching alone.
A cybersecurity vendor trains a malware classification model using 100,000 samples: 95,000 benign files and 5,000 malware samples. After deployment, the model achieves 96% accuracy but detects only 40% of actual malware in production. What problem exists and what preprocessing technique would BEST address it?
With 95% benign samples, the model learns to predict 'benign' for most inputs to maximize accuracy (96% accuracy by predicting benign for everything achieves 95% baseline). Class imbalance causes poor minority class (malware) detection. SMOTE generates synthetic minority class samples to balance training data, improving malware detection without simply duplicating existing samples.
A managed security service provider (MSSP) is selecting an AI architecture for real-time network intrusion detection across 50 enterprise clients. The solution must process 100 Gbps traffic per client, make sub-millisecond classification decisions, and deploy inference at client edge locations with limited GPU resources. Which neural network architecture BEST meets these requirements?
Shallow feed-forward networks with pruning provide the fastest inference times and smallest memory footprint required for edge deployment with limited GPU resources. They can achieve sub-millisecond latency needed for 100 Gbps real-time processing. Model pruning removes unnecessary weights to optimize for constrained edge environments while maintaining acceptable detection accuracy.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through August 23.
Get my $34.99 deal →