AI in Network Intrusion Detection Quiz

Answers and explanations appear as you take the quiz.

1. What can anomaly-based AI add to signature matching when previously unseen behavior appears?
   • It can flag deviations from learned normal traffic for investigation, without guaranteeing detection of every new attack
   • It can prove a deviation is malicious without review
   • It can identify every attacker by name
   • It can replace all security monitoring
2. How does anomaly-based detection typically identify threats?
   • By matching a database of known virus signatures
   • By learning normal behavior and flagging deviations from it
   • By blocking all encrypted traffic
   • By asking users to confirm each connection
3. How does an autoencoder help detect anomalous network traffic?
   • It encrypts the traffic for safety
   • It deletes suspicious packets automatically
   • High reconstruction error on new traffic signals an anomaly
   • It counts the number of users online
4. What is a major practical challenge for AI intrusion detection systems?
   • Networks being too quiet to monitor
   • A lack of any network traffic to analyze
   • Attacks being too easy to write signatures for
   • Too many false positives causing alert fatigue
5. Why is class imbalance a concern when training intrusion detection models?
   • Because attacks are rare compared to normal traffic
   • Because there are too many classes of users
   • Because networks have unequal bandwidth
   • Because all traffic is malicious
6. Which is an example of a traditional signature-based intrusion detection tool?
   • Photoshop
   • Snort
   • Excel
   • AlphaFold
7. What is the main difference between supervised intrusion classification and anomaly detection in the guide?
   • Supervised models use no labels
   • Anomaly detection requires every attack type to be labeled
   • Supervised models learn from labeled attack examples; anomaly models can learn a normal-traffic baseline
   • Both methods only examine packet payload text
8. Which traffic information can be used as model features in an intrusion detector?
   • Only the user’s password
   • Only the final alert color
   • The model’s GPU temperature
   • Packet sizes, connection durations, protocols and flow statistics