A is incorrect: While anonymization can reduce regulatory obligations since truly anonymous data may fall outside the scope of many data protection laws, relying solely on anonymization is impractical for an AI fraud detection system that needs personal identifiers to function effectively. Additionally, the standard for true anonymization varies across jurisdictions, and pseudonymized data remains regulated under GDPR. Reference: https://gdpr.eu/article-4-definitions/

B is correct: Building a unified compliance matrix is the best approach. By identifying overlapping requirements across GDPR, CCPA, and regional laws like Singapore's PDPA, and aligning controls with the strictest applicable standards, the organization creates a comprehensive governance framework. This approach ensures that all regulatory obligations are met simultaneously, simplifies compliance management, and enables forward compatibility as regulations evolve. Reference: https://www.nist.gov/itl/ai-risk-management-framework

C is incorrect: While GDPR is widely considered one of the most comprehensive data protection frameworks, it does not automatically supersede or satisfy all requirements of other regional laws. CCPA has unique opt-out provisions for data sale, and Singapore's PDPA has its own consent and notification requirements. Each jurisdiction may have specific obligations not covered by GDPR alone, making a GDPR-only approach insufficient for full compliance. Reference: https://gdpr.eu/

D is incorrect: While data localization can address certain sovereignty requirements, deploying completely separate and unconnected AI systems in each region is operationally impractical and undermines the effectiveness of fraud detection models that benefit from global pattern recognition. This approach also does not eliminate all compliance obligations, as each regional system still must comply with local data protection laws independently. Reference: https://www.nist.gov/itl/ai-risk-management-framework

A is correct: Under the EU AI Act, cybersecurity is an essential requirement for high-risk AI systems as defined in Article 15. A high-risk AI system that is not cybersecure is by definition not safe under the Act. Providers must implement technical measures to ensure resilience against adversarial attacks, prevent data manipulation, and protect against unauthorized access. These cybersecurity measures must remain active throughout the entire operational lifecycle, not just at the initial deployment stage.

B is incorrect: The EU AI Act requires that cybersecurity measures for high-risk AI systems span the entire lifecycle, not just the conformity assessment phase. Article 9 mandates an iterative risk management process that must remain active throughout the systems operational life. Post-market monitoring obligations further require providers to continuously collect and review information relevant to system performance and security, applying corrective actions as needed.

C is incorrect: The EU AI Acts cybersecurity requirements for high-risk AI systems apply regardless of whether the system processes personal data. Cybersecurity is an essential requirement tied to system safety, not data privacy. While GDPR may apply concurrently when personal data is involved, the AI Acts mandate for resilience against adversarial attacks, data manipulation prevention, and unauthorized access protection applies to all high-risk AI systems based on their risk classification alone.

D is incorrect: For high-risk AI systems under the EU AI Act, cybersecurity is a mandatory requirement, not a voluntary recommendation. Voluntary codes of conduct apply to minimal-risk AI systems. High-risk systems must demonstrate compliance with cybersecurity requirements as part of their conformity assessment before market placement, including technical measures for robustness, resilience against adversarial attacks, and protection against unauthorized manipulation.

A is incorrect: Correlating traffic against known indicators of compromise (IOCs) describes a threat intelligence matching approach, not unsupervised machine learning. While IOC correlation is valuable for identifying known threats, it cannot detect zero-day attacks because these threats have no existing indicators in any database. Threat intelligence integration complements unsupervised ML but does not define how unsupervised models operate.

B is incorrect: Training on labeled datasets of categorized attack patterns describes supervised machine learning, not unsupervised ML. Supervised learning requires pre-labeled examples of both normal and malicious traffic, making it effective for known threat categories but fundamentally limited for detecting zero-day attacks that have no prior labeled samples available in the training data.

C is correct: Unsupervised machine learning models learn normal network behavior patterns from unlabeled data and flag statistical deviations as potential threats. Since zero-day threats have no existing signatures, unsupervised ML is uniquely suited because it does not depend on prior labeled attack data. AI-driven NDR solutions use this approach to establish baselines of expected traffic behavior and identify anomalies that may indicate novel attacks not found in any signature database.

D is incorrect: Optimizing detection through reward-based feedback describes reinforcement learning, not unsupervised ML. Reinforcement learning uses a trial-and-error approach with rewards and penalties to improve decision-making over time. While useful in some security optimization applications, this is a distinct ML paradigm from unsupervised learning, which identifies patterns in unlabeled data without external feedback signals.

A is incorrect: Completely removing automated containment capabilities from the playbook eliminates the response acceleration benefits that SOAR orchestration provides. The recommended approach is not to remove containment automation entirely but to gate high-impact containment actions behind human approval while still allowing the AI to recommend and prepare those actions. This preserves the speed advantages of automation while maintaining appropriate oversight.

B is incorrect: Adding a secondary AI model to validate containment decisions introduces additional complexity, latency, and cost without addressing the fundamental governance requirement. The appropriate control for high-impact containment actions is human analyst approval, not additional AI-layer validation. Multiple AI models can share similar error patterns or biases, meaning a second model does not provide the same assurance as human oversight for critical actions.

C is incorrect: Allowing the AI to autonomously execute all high-impact containment actions introduces significant operational risk. If the AI model misclassifies an alert or encounters a novel scenario, autonomous execution of actions like host isolation or account disabling could cause widespread business disruption. Best practices for AI-assisted SOAR playbooks require human-in-the-loop approval for actions that affect system availability and user access, reserving full autonomy only for low-impact tasks with demonstrated accuracy.

D is correct: Requiring analyst approval is the best approach for high-impact containment actions in AI-assisted SOAR playbooks. Actions such as isolating hosts and disabling user accounts can directly disrupt business operations if triggered by a false positive. A tiered governance model dictates that high-impact actions must remain human-in-the-loop, requiring explicit analyst approval before execution, while the AI decision node still provides speed and consistency in generating the recommendation. This balances automation benefits with operational safety.

A is incorrect: This is incorrect. UEBA is specifically designed to detect unknown threats by identifying statistical deviations from established behavioral baselines, not by matching activity against known indicators of compromise from threat intelligence feeds. This behavioral approach is what makes UEBA effective at uncovering insider threats and compromised accounts that lack known signatures or indicators.

B is incorrect: This is incorrect. UEBA systems use machine learning to dynamically set per-entity thresholds based on observed behavior patterns, not fixed sensitivity values manually configured by analysts. The low initial alert volume is due to the baseline learning period, not alert suppression. Once the AI models are trained on sufficient historical data, dynamic thresholds are applied automatically.

C is correct: This is correct. UEBA systems require a learning period during which they ingest and analyze historical activity data to build dynamic behavioral baselines for each user and entity. During this baselining phase, the system has not yet established sufficient context to distinguish normal from anomalous behavior, which explains the low alert volume. Once baselines are established, the system can effectively compare ongoing activity against learned patterns to detect deviations indicative of insider threats.

D is incorrect: This is incorrect. Unlike signature-based or rule-based detection systems, UEBA relies on machine learning algorithms that automatically learn behavioral patterns from ingested data. UEBA does not require administrators to manually define detection signatures or rules. The system autonomously builds behavioral models from data sources such as authentication logs, access records, and network activity without predefined threat definitions.

A is incorrect: Model architecture, hyperparameters, and optimization settings support model version management and development governance but do not provide runtime security telemetry. These details help data scientists manage model iterations rather than identifying unauthorized access or anomalous query behavior at inference endpoints during production operations.

B is incorrect: Version tags, build artifact checksums, and deployment approvals are CI/CD governance records important for software supply chain integrity verification. While valuable for confirming deployment authenticity, they do not provide the real-time inference access data needed to detect active threats at production endpoints or support incident investigations.

C is incorrect: CPU usage, memory allocation, and network throughput are infrastructure performance metrics useful for capacity planning. While they can indirectly indicate unusual activity, they lack the specificity needed for security forensics, such as identifying which requester made a particular inference call or what data was processed through the model.

D is correct: Capturing requester identity, timestamps, and request-response metadata provides essential information for both threat detection and forensics. This data enables security teams to identify who accessed the model, when access occurred, and what data was processed per inference call. These audit elements support real-time anomaly detection through behavioral baselining and allow investigators to reconstruct complete attack timelines during post-incident analysis.

A is incorrect: Implementing output filtering restricts the content and format of model responses, which is valuable for preventing sensitive information disclosure or harmful outputs. However, output filtering does not control the volume or size of incoming requests. The attack described targets token consumption through crafted input prompts, so the appropriate mitigation must operate on the input access control and throttling side of the API gateway.

B is incorrect: Deploying an additional model instance distributes the inference workload across more resources but does not limit the volume of requests or token consumption from malicious accounts. Adding capacity without restricting access allows the attack to continue and may increase costs further by provisioning additional infrastructure. The correct approach is to limit consumption at the API gateway, not to scale resources to absorb the abusive traffic.

C is incorrect: Enabling TLS 1.3 on inbound API connections encrypts data in transit between clients and the inference endpoint, protecting communication confidentiality and integrity. However, TLS encryption does not restrict the volume of requests, the size of prompts, or the number of tokens consumed per account. It is a transport-layer security control that does not address resource consumption or cost inflation attacks against AI inference APIs.

D is correct: Enforcing token usage quotas and request throttling at the API gateway is the best control for mitigating this type of resource consumption attack, commonly known as a wallet attack or unbounded consumption. Token quotas limit how many tokens each account can consume within a defined period, while request throttling restricts the rate of incoming requests. Together, these controls prevent attackers from inflating costs through excessive token usage by capping consumption at the API access layer.

A is incorrect: Applying convolutional filters for spatial pattern extraction describes the operation of convolutional neural networks (CNNs), not transformers. CNNs use convolutional kernels to detect local features within grid-like data structures. The transformer self-attention mechanism operates differently by computing attention scores across all positions in the input sequence rather than applying localized spatial filters.

B is incorrect: Sequential processing with a running memory describes the behavior of recurrent neural networks (RNNs), not the self-attention mechanism in transformers. RNNs process data one step at a time, maintaining hidden states from previous inputs. Transformers specifically overcome this sequential limitation by using self-attention to process all elements in parallel without relying on recurrence.

C is incorrect: Generating synthetic data to expand training datasets describes a generative function, not the self-attention mechanism. While some transformer-based models have generative capabilities, self-attention specifically refers to the model's ability to compute weighted relationships between all elements within an input sequence to capture meaningful contextual patterns for detection.

D is correct: The self-attention mechanism in transformers allows the model to weigh the importance of every event relative to every other event in a log sequence simultaneously. This parallel processing capability enables the model to capture long-range dependencies and contextual relationships across the entire sequence without sequential bottlenecks. This makes transformers effective for identifying anomalies that depend on patterns spread across distant log events.

A is correct: Scoring alerts by correlating asset criticality, threat intelligence context, and anomaly severity is correct. AI-driven risk prioritization in a SIEM evaluates multiple contextual factors to assign dynamic risk scores. By combining asset criticality with threat intelligence enrichment and behavioral anomaly data, the AI model distinguishes high-impact threats targeting critical assets from lower-risk events, enabling analysts to focus on the most significant risks to the enterprise first.

B is incorrect: Forwarding untriaged alerts directly to incident response bypasses the risk prioritization process entirely. Without AI-driven scoring to evaluate and rank alerts by severity and business impact, the incident response team would be overwhelmed with unfiltered events. This approach defeats the purpose of risk prioritization, which ensures the most critical threats are identified and addressed before less significant events consume resources.

C is incorrect: Suppressing alerts from cloud environments creates dangerous blind spots in the organization's threat visibility. Cloud infrastructure is a critical part of the modern enterprise attack surface, and ignoring these alerts would leave the organization exposed to cloud-based threats. AI-driven risk scoring addresses alert fatigue through intelligent prioritization, not by eliminating legitimate categories of security telemetry from analysis.

D is incorrect: Processing alerts in chronological order treats all events as equally important regardless of their actual risk level. This approach ignores the contextual factors that AI-driven risk scoring is designed to leverage, such as asset criticality and threat actor relevance. Sequential processing would cause high-priority threats to be delayed behind lower-risk events, reducing the security team's ability to respond to the most critical threats first.

A is incorrect: Data poisoning attacks target the training data pipeline by injecting malicious or misleading samples to corrupt the model's learning process. Data poisoning occurs during model training, not during inference. The scenario describes suspicious activity at the inference endpoint through high-volume queries, not manipulation of training data, making data poisoning inconsistent with the observed behavior pattern.

B is correct: Model extraction is the most likely attack indicated by this behavior. Model extraction attacks involve an attacker systematically querying an AI model's inference API with diverse, structured inputs to replicate the model's functionality or extract its parameters. The combination of high-volume queries from a single account and systematic coverage of diverse input categories is a hallmark pattern of model extraction, where the attacker builds a surrogate model from the collected input-output pairs. Monitoring query patterns for these indicators is a recommended defense.

C is incorrect: Prompt injection attacks involve crafting specific inputs designed to override or manipulate the model's instructions to produce unintended outputs. While prompt injection targets the inference layer, it typically focuses on manipulating a single response rather than systematically querying the model across diverse categories. The systematic and high-volume nature of the queries described is more characteristic of extraction than manipulation.

D is incorrect: Adversarial evasion attacks use carefully crafted inputs to cause a model to misclassify or produce incorrect outputs, typically by introducing subtle perturbations. These attacks aim to fool the model on specific inputs rather than systematically query it across broad input categories. The described pattern of diverse, high-volume queries aimed at covering many input categories aligns with extraction, not evasion.