CCNA AI and Network Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AI models can detect zero-day exploits by analyzing behavioral anomalies

  Why this is correct

  AI models, especially unsupervised learning, establish baseline behavioral profiles for users, endpoints, and network flows. Because zero-day exploits have no known signature, detection relies on flagging anomalous actions—such as unusual process injection, abnormal outbound callbacks, or uncharacteristic lateral movement—that deviate from the learned baseline. The model generalizes from prior malicious behavior rather than matching a static file hash or pattern, enabling discovery of novel attacks.

• ✓

  AI-powered systems can correlate logs from multiple sources to identify complex attack chains

  Why this is correct

  AI-powered systems ingest and normalize telemetry from disparate sources—firewall denies, DNS queries, Windows Event IDs, and cloud audit logs—then use graph and temporal correlation to fuse individual events into a multi-stage attack sequence. A phishing email, a credential dump, a privilege escalation, and an exfiltration upload may each look benign in isolation, but the AI connects them through causality and time-window analysis. This reveals the full kill-chain, letting SOC teams see the incident's progression rather than isolated false-positive alerts.

• ✓

  AI can automate the response to certain security incidents, such as blocking malicious IPs

  Why this is correct

  Through SOAR integration, AI can execute playbook-driven countermeasures on security devices, such as pushing a block entry to a firewall's dynamic ACL or updating an IP reputation feed to drop malicious traffic at the edge. The automation occurs in near real time after high-confidence classification, shrinking incident response time from minutes to milliseconds. Crucially, these responses run within human-defined policy guardrails, so the AI enforces a sanctioned containment action rather than inventing policy.

• ✗

  AI is only effective against known, signature-based threats

  Why it's wrong here

  This is false because AI's core value is generalization beyond known indicators. Signature-based tools only match a static pattern—hash, byte string, or specific exploit signature—and therefore miss novel or polymorphic threats. Supervised and unsupervised AI models evaluate feature patterns and behavior, allowing them to classify suspicious activity that has no published signature, such as a zero-day or an insider abusing legitimate credentials. If AI were only signature-based, it would add little over traditional antivirus.

• ✗

  AI eliminates the need for firewall rules and access control lists

  Why it's wrong here

  This is incorrect because AI augments, rather than replaces, deterministic policy enforcement. Firewalls and ACLs remain the foundation for network segmentation, default-deny traffic control, and access restriction, operating on explicit rules that cannot be 'learned' away. In fact, when AI blocks an offending IP or contains a host, it typically does so by programmatically modifying an existing ACL or dynamic firewall rule—proving that these controls are still necessary and in effect.

• ✗

  AI security models require no human oversight once deployed

  Why it's wrong here

  This is wrong because security AI systems require continuous human oversight for effective operation. Models must be monitored for concept drift, retrained on new data, and audited for false positives/negatives that can disrupt legitimate business flows. Analysts also provide critical ground truth, adjudicating ambiguous high-severity alerts and reviewing automated actions to prevent unintended consequences. Compliance frameworks further mandate human review, and without oversight, adversarial attacks such as data poisoning or prompt injection can silently corrupt model decisions.

Go deeper

Related to this question