CCNA AI and Network Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Using historical baseline traffic data to learn normal behavior patterns

  Why this is correct

  Historical baseline traffic data is the core substrate for anomaly-based machine learning models. These models are trained on flow records, packet captures, or NetFlow data to establish a statistical profile of normal behavior, such as typical protocol mixes, packet sizes, and session durations. After training, the model flags deviations from this learned baseline as potential anomalies. This approach is powerful because it does not require prior knowledge of attacks, only a representative sample of benign traffic.

• ✓

  Labeling datasets with known attack signatures for supervised learning

  Why this is correct

  Labeled datasets with known attack signatures enable supervised learning classifiers, such as decision trees, support vector machines, or neural networks, to map traffic features to specific attack classes. Each sample is tagged as benign or malicious, allowing the model to learn decision boundaries that separate attack traffic from legitimate traffic. This is analogous to traditional signature-based intrusion detection, but the ML model generalizes beyond exact signatures to polymorphic or obfuscated variants. Supervised learning requires high-quality, balanced labels and is ineffective against never-before-seen attack types.

• ✓

  Applying unsupervised clustering to identify deviations without predefined labels

  Why this is correct

  Unsupervised clustering, such as k-means, DBSCAN, or autoencoders, discovers hidden structure in unlabeled network traffic data without requiring predefined attack labels. The algorithm groups similar connections into clusters representing common traffic patterns, and observations that fall far from any cluster centroid or in low-density regions are flagged as outliers or anomalies. This technique is uniquely suited for zero-day attack detection because it does not need a database of known signatures or prior labeling. Its main challenge is distinguishing between benign novelty and true malicious activity, leading to potential false positives.

• ✗

  Requiring manual threshold configuration for every monitored metric

  Why it's wrong here

  Requiring manual threshold configuration for every monitored metric is the antithesis of machine learning training. Traditional threshold-based systems, like those that alarm when CPU usage exceeds 80% or when packets per second exceed a fixed value, are static and fail to adapt to changing network conditions. Manually setting thresholds for thousands of metrics is operationally unsustainable, creates brittle rules, and cannot capture complex multivariate correlations. In contrast, ML models automatically learn dynamic thresholds and relationships from historical data, removing the need for per-metric engineering.

• ✗

  Training exclusively on synthetic data generated by simulation tools

  Why it's wrong here

  Training exclusively on synthetic data generated by simulation tools is insufficient for production network security ML. While synthetic traffic can provide large volumes of labeled data and cover rare attack scenarios, real-world traffic contains a long tail of legitimate protocols, application-specific quirks, encryption patterns, and user behaviors that simulators rarely reproduce faithfully. A model trained solely on synthetic data will exhibit domain shift, meaning it will perform poorly when deployed against actual network telemetry. Therefore, synthetic data is used only as a supplement or pre-training step, not as the sole training corpus.

• ✗

  Relying solely on SNMP polling intervals to detect anomalies

  Why it's wrong here

  Relying solely on SNMP polling intervals to detect anomalies limits the temporal resolution and feature depth available to an ML model. SNMP polling typically occurs every 5–15 minutes and only exposes coarse counters like interface utilization, packet counts, or error rates, which can conceal short-lived attacks such as port scans or single-packet exploits. Such polling provides no flow-level or packet-level context, such as TCP flags, payload patterns, or conversation endpoints, which are essential for detecting sophisticated intrusions. Modern ML-based NIDS instead ingest streaming telemetry like NetFlow, IPFIX, or full packet capture to enable real-time, fine-grained anomaly detection.

Go deeper

Related to this question