AI0-001 AI Concepts and Techniques Practice Question
An AI engineer is designing a system to detect unusual patterns in network traffic that may indicate a security breach. The system should learn from normal traffic patterns and flag deviations. Which machine learning approach is MOST appropriate?
⚠ Common exam trap
The AI0-001 exam often tests the misconception that semi-supervised learning (Option C) is a middle ground for anomaly detection, but the trap is that it still requires labeled attack data, which is unavailable for unknown security breaches, making unsupervised methods the only viable choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unsupervised anomaly detection
Unsupervised anomaly detection is the most appropriate approach because the system must learn 'normal' traffic patterns from unlabeled data and then flag deviations without requiring pre-labeled examples of attacks. This aligns with the core requirement of detecting unknown or novel security breaches, which supervised methods cannot handle due to the lack of labeled attack data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reinforcement learning with reward shaping
Why it's wrong here
Reinforcement learning optimises sequential actions against a reward signal, but anomaly detection has no agent, environment or reward to shape; the stem needs unsupervised modelling of normal traffic. It tempts because reward shaping appears to handle unlabelled feedback, and would fit tasks like adaptive traffic routing.
- ✗
Supervised classification using logistic regression
Why it's wrong here
Labelled normal and breach traffic is unavailable, so logistic regression cannot be trained; the stem requires learning normal patterns and flagging deviations, which is anomaly detection. It tempts because classification suits known attack signatures, and would be correct given labelled examples of each class.
- ✗
Semi-supervised learning with a small labeled set
Why it's wrong here
Semi-supervised learning still needs labels for the anomalous class to separate it, whereas the stem supplies only normal traffic and expects deviations to be flagged without breach examples. It tempts because small labelled sets reduce annotation effort, and would fit if a few confirmed breach samples existed.
- ✓
Unsupervised anomaly detection
Why this is correct
Unsupervised anomaly detection learns the baseline distribution of normal traffic without labelled attack examples, then flags statistical deviations. This matches the scenario's constraint that breaches are unknown in advance, unlike supervised classification which needs labelled attack samples.
About these practice questions
Courseiva writes every AI0-001 question from scratch — 962 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI0-001 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI0-001 exam.