CCNA AI and Network Operations Practice Question

Correct answer & explanation

Machine learning models for network anomaly detection are effectively trained using historical baseline traffic data to learn normal behavior patterns, which allows the model to identify deviations that may indicate anomalies. Labeled datasets with known attack signatures enable supervised learning, where the model learns to classify traffic as normal or malicious based on examples. Unsupervised clustering techniques, such as k-means or DBSCAN, can identify deviations without predefined labels by grouping similar data points and flagging outliers as potential anomalies. The three incorrect options—manual threshold configuration, training exclusively on synthetic data, and reliance on SNMP polling—are not characteristic of ML training methods. Manual threshold configuration is a rule‑based approach that does not involve learning from data. Training exclusively on synthetic data is not representative of real‑world traffic patterns and would not generalize well. Relying solely on SNMP polling intervals is a traditional monitoring method, not a machine learning technique.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.