CCNA AI and Network Operations Practice Question
A network administrator at a large enterprise notices that the network monitoring system frequently generates false positive alerts for unusual traffic patterns during normal business hours. The administrator wants to reduce these false positives while still detecting genuine security threats. Which AI/ML concept would best address this requirement?
⚠ Common exam trap
Cisco often tests the distinction between predictive analytics (forecasting volume) and anomaly detection (learning behavior), trapping candidates who confuse adjusting thresholds with establishing a behavioral baseline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement an anomaly detection system that uses machine learning to establish baseline behavior and flag deviations.
Anomaly detection using machine learning establishes a dynamic baseline of normal network behavior, allowing the system to flag only significant deviations. This reduces false positives during normal business hours while still detecting genuine threats that deviate from the learned baseline, unlike static thresholds that trigger alerts on routine traffic variations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a predictive analytics model to forecast future traffic volumes and adjust thresholds accordingly.
Why it's wrong here
Predictive analytics models apply time-series forecasting to anticipate future traffic loads (e.g., bandwidth utilization during peak hours) and proactively adjust thresholds. This approach is inherently prospective—it does not compute a real-time baseline of 'normal' behavior across multiple features, so it cannot distinguish a genuine security anomaly from a routine but irregular spike. Adjusting thresholds based on forecasts may actually increase false positives when the forecast is inaccurate, and it still lacks the per-flow or per-host behavioral comparison needed to suppress alert noise.
- ✓
Implement an anomaly detection system that uses machine learning to establish baseline behavior and flag deviations.
Why this is correct
An ML-based anomaly detection system builds a statistical baseline of normal network behavior by learning from historical telemetry—metrics such as traffic volume, packet rates, port usage, or flow duration—and then flags significant deviations from that learned profile. Unlike static thresholds, the model adapts to seasonal patterns and gradual shifts in user behavior, so routine variations are absorbed into the baseline and only genuine outliers trigger alerts. This combination of continuous learning and multi-dimensional feature analysis directly addresses the root cause of false positives, which is the inability of fixed rules to distinguish 'unusual but normal' from 'suspicious' traffic.
- ✗
Apply intent-based networking to automatically enforce security policies based on high-level business intent.
Why it's wrong here
Intent-based networking (IBN) automates the translation of high-level business policies into concrete device configurations and continuously validates that the network state meets that intent. However, IBN operates on policy assurance and configuration management; it does not ingest traffic telemetry to learn what normal traffic looks like, nor does it classify live traffic as benign or malicious. False positive alerts from an existing NMS or IDS remain untouched because IBN does not add a layer of statistical or behavioral analysis to the monitoring pipeline—it simply enforces and verifies the intended state.
- ✗
Use deep packet inspection to examine all traffic and create static rules for known threats.
Why it's wrong here
Deep packet inspection (DPI) examines packet payloads against a signature database to identify known attack patterns, then applies static rules (e.g., drop or alert). While DPI is effective for known exploits, it is blind to behavioral anomalies that have no matching signature—zero-day attacks or subtle deviations in traffic volume, latency, or flow topology. Because the rules are static, they cannot adapt to evolving baseline behavior, so legitimate traffic that coincidentally resembles a signature (e.g., a malformed but benign packet) triggers false positives, and genuinely abnormal traffic without a signature goes unnoticed.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Implement an anomaly detection system that uses machine learning to establish baseline behavior and flag deviations.Correct answer▾
Why this is correct
An ML-based anomaly detection system builds a statistical baseline of normal network behavior by learning from historical telemetry—metrics such as traffic volume, packet rates, port usage, or flow duration—and then flags significant deviations from that learned profile. Unlike static thresholds, the model adapts to seasonal patterns and gradual shifts in user behavior, so routine variations are absorbed into the baseline and only genuine outliers trigger alerts. This combination of continuous learning and multi-dimensional feature analysis directly addresses the root cause of false positives, which is the inability of fixed rules to distinguish 'unusual but normal' from 'suspicious' traffic.
✗Deploy a predictive analytics model to forecast future traffic volumes and adjust thresholds accordingly.Wrong answer — click to see why▾
Why this is wrong here
Predictive analytics forecasts future traffic volumes but does not establish a dynamic baseline for normal behavior; thus, it cannot adapt to daily variations and would not reduce false positives from current traffic patterns.
Why candidates choose this
Students may think that forecasting future traffic helps adjust thresholds, but this approach is reactive and does not learn normal patterns, making it ineffective for reducing false positives.
✗Apply intent-based networking to automatically enforce security policies based on high-level business intent.Wrong answer — click to see why▾
Why this is wrong here
Intent-based networking automates policy deployment and verification based on business intent, but it does not analyze traffic patterns or adapt alert thresholds; therefore, it does not directly reduce false positive alerts from monitoring systems.
Why candidates choose this
Students may confuse intent-based networking with adaptive security, but its primary function is policy automation, not anomaly detection or false positive reduction.
✗Use deep packet inspection to examine all traffic and create static rules for known threats.Wrong answer — click to see why▾
Why this is wrong here
Deep packet inspection with static rules can detect known threats but cannot adapt to new or evolving traffic patterns; thus, it would not reduce false positives from normal traffic variations and may even increase them due to rigid rules.
Why candidates choose this
Students might think that deep packet inspection provides thorough analysis, but without machine learning to establish baselines, it lacks the adaptability needed to minimize false positives.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Agentic AI in Network Operations
Key term
Baseline
A baseline is a documented starting point for the normal performance and behavior of a system, network, or component, used to detect changes and troubleshoot issues.
Key term
Network monitoring
Network monitoring is the practice of continuously observing a computer network for issues like slow performance, failures, or security threats to keep it running smoothly and reliably.
About these practice questions
One of 1,389 original 200-301 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.