CS0-004 - Security Operations (34% of the exam) - Section 1.6
Summarize concepts related to the use of AI in security operations.
Summarise how AI and machine learning support security operations - anomaly detection, alert triage, and enrichment - and the risks they introduce, including adversarial manipulation, data poisoning, hallucinated output, and governance and privacy concerns. Recognise that AI augments rather than replaces analyst judgement and that its output must be validated against evidence.
AI and machine learning in detectionadversarial AI and data poisoningAI governance and privacyalert triage augmentationvalidating AI output
Practice question for this objective
lock_openFree sampleSecurity Operationseasy
An analyst reviews an alert raised by the SOC's machine learning detection model, which flagged a finance workstation for anomalous outbound traffic. The model reports a confidence score of 0.42 and no supporting rule or signature match. Before escalating, what should the analyst do first?
AEscalate the alert to incident response immediately because the detection model classified the host as beaconing.
BSuppress the alert and retrain the model, since a 0.42 confidence indicates the detection logic is faulty.
CBlock the destination address at the firewall before any further review of the traffic.
DValidate the model output by examining the underlying flow evidence to confirm whether the behaviour is genuinely anomalous.check_circle Correct
Analysts must validate AI or machine learning detection output against underlying evidence before treating it as an actionable finding. Machine learning detections are probabilistic and can produce false positives, so a low-confidence flag with no corroborating signature requires the analyst to confirm it against the raw telemetry before escalation or containment.
Why A is wrong: Tempting because ML output can feel authoritative, but escalating an unvalidated low-confidence flag wastes response resources and skips triage.
Why B is wrong: Tempting because low confidence looks like a model defect, but a single low score is not evidence of a broken model and suppression hides a possible true positive.
Why C is wrong: Tempting as a fast containment move, but blocking on an unconfirmed low-confidence flag risks disrupting legitimate business traffic without evidence.
Why D is correct: Correct: a low-confidence ML flag with no corroborating signature is a lead, not a verdict, so the analyst confirms it against the raw evidence before acting.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CS0-004 bank for this domain.
Disable all AI triage assistance permanently, as it has proven unable to prioritise alerts correctly.
errorWhy it is wrong: Tempting after a visible miss, but a single prioritisation error does not justify removing a tool that reduces overall triage load; the fix is oversight, not abandonment.
A privacy governance failure, because the training data included records that should have been anonymised first.
errorWhy it is wrong: Tempting because governance of training data is a real concern, but the issue here is corrupted labels degrading detection, not exposure of private data.
Escalate immediately to incident response because a 0.94 confidence score exceeds the accepted alerting threshold.
errorWhy it is wrong: Tempting because a high score feels decisive, but a confidence value is not corroborating evidence and escalating on an unvalidated model verdict risks acting on a false positive.