A large financial organization has experienced an increase in sophisticated cyber threats, including zero-day attacks and APTs. Traditional detection relies heavily on signatures and manual interventi

Question

Options

• AStatic IP blocking
• BMachine learning (ML)
• CNatural language processing (NLP)
• DHeuristic-based signature detection

• A
  4% (2)
• B
  94% (49)
• C
  2% (1)

Explanation

Machine learning is the key AI technology for detecting suspicious activity without predefined signatures by learning patterns from data and identifying anomalies, outliers, and high-risk behaviors. In SOC contexts, ML can model normal baselines for users, hosts, and applications, then flag deviations such as unusual authentication patterns, unexpected data transfers, or rare process behaviors-capabilities that are particularly useful against zero-days and APTs that evade signature- based tools. NLP is valuable for processing human-language text (tickets, email content, narrative logs), but it is not the primary engine for behavioral anomaly detection across telemetry. Static IP blocking is a manual control that can be bypassed and does not “learn” or adapt. Heuristic-based signatures still rely on predefined patterns, even if they are generalized, and are not the same as adaptive learning. From a SOC perspective, ML can improve detection coverage when combined with strong telemetry and tuning, but it also requires governance: monitoring model drift, validating outputs, and ensuring explainability for analysts. Because the scenario prioritizes signatureless detection and real-time adaptation, machine learning is the best fit.

No community discussion yet for this question.