AI in Cybersecurity Operations Quiz

Answers and explanations appear as you take the quiz.

1. What does anomaly-based detection do that signature-based detection does not?
   • It only blocks known viruses by their fingerprint
   • It learns normal behavior and flags deviations from it
   • It requires no data to operate
   • It disables the network during scans
2. What does UEBA stand for in security operations?
   • User and Entity Behavior Analytics
   • Universal Encryption Backup Algorithm
   • Unified Endpoint Backup Application
   • Untrusted External Browser Access
3. Why are false positives a major problem for AI in a SOC?
   • They make models run faster
   • They improve detection accuracy
   • Analysts start ignoring alerts if there are too many false alarms
   • They are required by regulation
4. Which misuse did the NCSC’s 2024 AI cyber-threat assessment discuss as a social-engineering concern?
   • Automatic elimination of all attacker errors
   • A requirement that attackers use no human expertise
   • A guarantee that every AI output contains malware
   • Assistance producing more persuasive phishing material
5. What is a key risk of relying on AI security copilots powered by LLMs?
   • They can be manipulated via prompt injection
   • They run too quietly
   • They make networks impossible to use
   • They eliminate the need for any security at all
6. What does automated containment mean in a security-response workflow?
   • Guaranteeing every threat is detected before damage
   • Only writing a quarterly summary
   • Taking a configured action such as isolating a host when the workflow’s conditions are met
   • Making analyst permissions unnecessary
7. A behavior model flags a legitimate overnight backup as unusual data transfer. What does this example illustrate?
   • Every unusual transfer proves an intrusion
   • Normal backups cannot appear in security logs
   • Behavior scores automatically determine malicious intent
   • An anomaly can be a false positive and needs investigation
8. An AI incident summary names a compromised account that the logs do not support. What should the analyst do?
   • Revoke every account because generated text is authoritative
   • Check the underlying evidence before acting on the generated claim
   • Delete the logs to match the summary
   • Treat fluent wording as proof of compromise