A is incorrect: EDR does not eliminate the need for antivirus or prevent all malicious executables from running. EDR complements antivirus by adding behavioral detection, post-breach analysis, and automated response capabilities. EDR detects and responds to threats that bypass initial prevention layers, working alongside existing antivirus solutions rather than replacing them. Many EDR platforms are designed to enhance, not replace, traditional endpoint protection capabilities. Reference: https://learn.microsoft.com/en-us/defender-endpoint/edr-in-block-mode

B is incorrect: EDR operates primarily at the endpoint level, monitoring process behaviors and system activities on individual devices, not at the network perimeter. Network firewalls and EDR solutions serve different roles in a defense-in-depth architecture. Firewalls filter network traffic at boundaries, while EDR monitors endpoint runtime behaviors. Polymorphic malware evasion is an endpoint detection challenge that requires behavioral endpoint analysis, not network perimeter controls.

C is incorrect: While EDR solutions may leverage cloud intelligence, their primary advantage against polymorphic malware is behavioral analysis, not a larger signature repository. The root problem is that signature-based detection cannot scale to match the rate of AI-enhanced polymorphic variant generation. A larger database using the same signature-matching methodology does not address the fundamental scalability limitation that causes declining detection rates against rapidly mutating threats. Reference: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/behavioral-blocking-containment

D is correct: EDR using AI-driven behavioral analysis is the correct justification. EDR solutions leverage AI and machine learning to monitor and analyze process behaviors, system call patterns, and process trees during runtime execution. Since polymorphic malware must still execute the same malicious behaviors to achieve its objectives regardless of code mutations, behavioral analysis can identify threats that signature-based approaches fundamentally cannot keep pace with. This shifts detection from matching static code patterns to identifying malicious activity patterns. Reference: https://www.microsoft.com/en-us/security/business/security-101/what-is-edr-endpoint-detection-response

A is incorrect: This is incorrect. While data exfiltration involves unauthorized transfer of data outside the organization, the scenario specifically describes a user account accessing multiple internal servers across network segments. This access pattern across previously unvisited internal systems is characteristic of lateral movement, not outbound data transfer to external infrastructure. UEBA would generate a different anomaly type for unusual outbound data transfer volumes.

B is correct: Lateral movement is correct. UEBA systems track which resources each user and entity typically accesses and build behavioral baselines over time. When a standard user account suddenly begins accessing multiple servers across different network segments with no prior connection history, this pattern is a strong indicator of lateral movement, where an attacker uses compromised credentials to traverse the network in search of valuable targets. UEBA flags this deviation from the user's normal access baseline.

C is incorrect: This is incorrect. A brute-force attack involves repeated login attempts using different credentials against a single target to guess valid passwords. The scenario describes a user account successfully accessing multiple servers across different network segments, which indicates movement through the environment rather than repeated failed authentication attempts against one system. UEBA distinguishes these patterns through different behavioral anomaly detection models.

D is incorrect: This is incorrect. Phishing campaigns involve sending deceptive messages to trick recipients into revealing credentials or executing malicious payloads. The scenario describes internal network behavior where a user account is accessing servers it has never connected to before. Phishing is an initial access technique targeting users externally, whereas the UEBA alert describes post-compromise activity involving internal resource access across the network infrastructure.

A is incorrect: Mutual TLS provides strong bidirectional authentication by requiring both client and server to present certificates, ensuring only authenticated clients connect to the API. While mTLS prevents unauthorized access, it does not limit how many resources an authenticated user can consume. An attacker using valid credentials and a legitimate certificate could still send resource-intensive prompts that consume excessive tokens and drive up costs. Reference: https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/

B is correct: Enforcing token-based rate limits and spending quotas is the best mitigation for this attack, commonly referred to as a wallet attack or unbounded consumption. Token-based rate limiting restricts how many tokens each user or application can consume within a defined period, while spending quotas set hard financial caps on usage. Together, these controls prevent any single actor from generating excessive costs by constraining both the volume and the financial impact of API consumption at the gateway level. Reference: https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/

C is incorrect: Output content filtering inspects model-generated responses for harmful, toxic, or policy-violating content before delivery to the user. While important for responsible AI and preventing output abuse, content filtering does not address the resource consumption problem. The tokens are already consumed during model inference before the output is filtered, meaning the financial cost has already been incurred regardless of whether the response is ultimately blocked or delivered. Reference: https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/

D is incorrect: Diagnostic logging captures detailed records of API interactions including request payloads, response metadata, token usage, and error codes, which supports audit and forensic investigation. However, logging is a detective control that records events after they occur and does not actively prevent token overconsumption. The financial damage continues to accumulate while logs are being generated, requiring separate preventive controls to stop the attack. Reference: https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/

A is correct: According to the NIST AI RMF, transparency, explainability, and interpretability are distinct but related characteristics that support each other. Transparency answers 'what happened' in the system, explainability answers 'how' a decision was made by representing the mechanisms underlying the AI system's operation, and interpretability answers 'why' a decision was made by describing its meaning in the context of the system's designed functional purpose. Understanding these distinctions is essential for defining XAI requirements in governance policies. Reference: https://airc.nist.gov/airmf-resources/airmf/3-sec-characteristics/

B is incorrect: This option incorrectly assigns the 'what happened' characteristic to explainability instead of transparency. According to the NIST AI RMF, explainability specifically describes the mechanisms underlying how AI systems operate and reach decisions, not what occurred in the system. Additionally, interpretability is not limited to deep learning models. It applies across all AI system types and describes the meaning of outputs in the context of the system's designed functional purpose. Reference: https://airc.nist.gov/airmf-resources/airmf/3-sec-characteristics/

C is incorrect: Transparency and explainability are not equivalent concepts under the NIST AI RMF. They are distinct characteristics that support each other but address different aspects of trustworthy AI systems. Transparency focuses on openness about system operations, while explainability focuses on representing the decision-making mechanisms. Interpretability describes the meaning of outputs, not model accuracy, which falls under the 'valid and reliable' trustworthiness characteristic. Reference: https://airc.nist.gov/airmf-resources/airmf/3-sec-characteristics/

D is incorrect: This option incorrectly maps all three characteristics. Under the NIST AI RMF, interpretability answers 'why' not 'what happened,' transparency answers 'what happened' not 'why,' and explainability applies to all AI systems regardless of whether they are open-source or proprietary. These distinctions are based on the type of information each characteristic provides about the AI system, not on the model's licensing or architecture type. Reference: https://airc.nist.gov/airmf-resources/airmf/3-sec-characteristics/

A is incorrect: Audit logging and alerting are valuable detective controls that can identify when unauthorized access occurs, but they do not prevent access in real time. By the time an alert is triggered and investigated, sensitive training data may have already been exfiltrated. Preventive controls like service perimeters block unauthorized access at the network boundary before data exposure occurs, making them more effective against IAM misconfigurations. Reference: https://cloud.google.com/vpc-service-controls/docs/overview

B is incorrect: Customer-managed encryption keys give organizations control over the cryptographic keys used to encrypt data at rest. However, encryption does not prevent unauthorized read access when IAM permissions allow it, because the cloud platform decrypts data transparently for any request that passes IAM authorization. The misconfigured IAM policy would still permit external users to read the decrypted data. Encryption protects against storage-level compromise, not IAM misconfigurations. Reference: https://cloud.google.com/vpc-service-controls/docs/overview

C is correct: A service perimeter provides an additional layer of security that operates independently of IAM policies. Service perimeters enforce context-based access controls that deny requests to protected resources from outside the defined trusted boundary regardless of IAM permissions. Even when IAM policies are misconfigured to allow public access, the service perimeter blocks external requests, providing defense in depth specifically against data exposure from identity policy errors. Reference: https://cloud.google.com/vpc-service-controls/docs/overview

D is incorrect: Data classification tags and approval workflows are governance mechanisms that can enforce review processes before permissions are granted. However, classification tags alone do not enforce real-time access control at the network layer. If an IAM policy is misconfigured to bypass the approval process, the tag does not prevent access. Service perimeters enforce technical boundaries that cannot be overridden by IAM policy changes alone. Reference: https://cloud.google.com/vpc-service-controls/docs/overview

A is incorrect: Permanently removing the AI tool and reverting entirely to manual processes is a disproportionate response that eliminates the potential benefits of the AI system. The appropriate action is to enforce the specific policy requirement that was violated by implementing human review checkpoints, not to abandon AI-assisted processes altogether. The AUP establishes conditions for acceptable use, not a blanket prohibition on AI tools.

B is incorrect: Allowing continued use while waiting for the vendor to add oversight features in a future update leaves employees subject to consequential automated decisions without the safeguards required by the AUP. This approach undermines the enforceability of the policy and exposes the organization to risk during the interim period. Policy violations involving consequential decisions should be remediated before continued use, not deferred to a future release cycle.

C is correct: Halting the tool's deployment until human oversight controls are implemented is the most appropriate governance response. The AI Acceptable Use Policy establishes enforceable requirements, and deploying an AI system for consequential employee decisions without the required human review checkpoints represents a direct policy violation. Suspending use until the control gap is remediated maintains policy integrity and protects employees from unreviewed automated decisions that may be biased or inaccurate.

D is incorrect: Reassigning administration to the security operations center changes who manages the tool but does not address the missing human oversight requirement for promotion decisions. The AUP requires human review of the AI's consequential outputs, which is a decision workflow control, not a system administration concern. SOC monitoring focuses on security events, not on providing substantive human review of employee promotion recommendations.

A is incorrect: A daily maximum action limit would apply regardless of the specific target system or confidence level, stopping all automated actions once a count is reached. The scenario describes a targeted pause triggered by the combination of asset criticality and low model confidence rather than an exhaustion of a global daily action quota.

B is incorrect: An API connectivity failure would result in a technical error condition rather than a designed pause in the workflow based on confidence scoring and asset classification. The scenario specifically indicates the workflow paused due to the combination of a critical production server and a low AI confidence score, which reflects intentional decision logic.

C is correct: A human-in-the-loop approval gate is correct. AI-powered SOAR playbooks should include configurable checkpoints that pause execution when high-impact actions target critical assets and the AI model has low confidence in its classification. This design ensures that automated remediation does not cause unintended disruption to essential production systems by requiring human validation before containment actions proceed on high-value targets.

D is incorrect: Adversarial attack detection against alert data is a separate security concern related to model integrity and data pipeline protection. The scenario describes the playbook pausing based on its built-in confidence threshold and asset criticality logic, not because the AI system detected manipulation of the alert data stream by an external attacker.

A is incorrect: Threat intelligence integration is designed to complement ML-based detection, not replace it. Replacing the ML engine with signature-based rules would eliminate the system's ability to detect unknown or novel threats through behavioral analysis. The strength of an integrated approach lies in combining anomaly detection with threat intelligence context for more comprehensive detection coverage.

B is incorrect: Threat intelligence feeds provide indicators of compromise and contextual threat data, not labeled training datasets for ML model retraining. While threat intelligence enriches detection and response workflows, retraining unsupervised ML models requires curated baseline data and is managed through MLOps pipelines, not through the automatic ingestion of threat intelligence indicator feeds.

C is incorrect: No threat intelligence feed can provide a comprehensive list of all attack vectors, especially zero-day or novel threats. Behavioral baseline monitoring remains essential for detecting unknown threats that do not appear in any threat intelligence database. Threat intelligence supplements baseline monitoring by adding context to detections but does not eliminate the need for continuous behavioral analysis.

D is correct: Integrating threat intelligence with ML-powered NDR combines the strengths of both approaches. When the unsupervised ML model flags anomalous behavior, threat intelligence provides contextual enrichment by cross-referencing indicators such as IP addresses, domains, or behavioral patterns against known threat actor infrastructure. This correlation reduces false positives by validating anomaly detections against external threat data and allows analysts to prioritize alerts with both anomalous behavior and threat intelligence matches.

A is incorrect: Direct prompt injection occurs when a user directly provides malicious input to the LLM through the chat interface to override system instructions. In this scenario, the manipulation was not performed through user input at the chat interface but rather through a poisoned document in the external knowledge base that the LLM processes during retrieval. The injection vector is indirect, not direct. Reference: https://genai.owasp.org/llmrisk/llm01-prompt-injection/

B is incorrect: Training data poisoning involves manipulating the data used to train or fine-tune a model, introducing backdoors or biases into the model weights. In this scenario, the attacker modified a document in the knowledge base used at inference time for retrieval-augmented generation, not the data used during the model's original training phase. The attack targets runtime data sources, not the training pipeline. Reference: https://genai.owasp.org/llmrisk/llm01-prompt-injection/

C is correct: Indirect prompt injection is the correct answer. This attack occurs when an LLM accepts input from external sources, such as documents or files in a knowledge base, that contain malicious instructions crafted by an attacker. The attacker embedded instructions in the modified document that the LLM misinterpreted as legitimate commands during inference, causing it to redirect users to an unauthorized URL. This is a classic indirect injection vector targeting the RAG retrieval layer.

D is incorrect: A model inversion attack involves exploiting a model's API or outputs to reconstruct sensitive training data or infer private information about individuals in the training set. The scenario describes a behavioral manipulation where the LLM is tricked into issuing unauthorized instructions to users, which is fundamentally different from attempting to extract private data through inference queries.

A is correct: The server accessing multiple internal hosts on previously unused administrative ports is indicative of lateral movement, where a compromised system attempts to spread through the internal network. Simultaneously, the small encoded payloads sent to an external address represent command-and-control communication. AI-based NDR identifies this compound behavior by comparing current traffic against established baselines for both internal and external communications.

B is incorrect: Load balancing distributes client traffic across servers using established and predictable patterns on designated application service ports. The scenario describes connections to administrative ports never previously accessed combined with outbound encoded data to an external address, which are inconsistent with legitimate load balancing and instead indicate system compromise and attacker activity.

C is incorrect: Routine vulnerability scanning by IT operations follows predictable patterns using authorized scanning tools and does not involve sending encoded payloads to external addresses. The NDR platform flagged this activity because it deviates from the server's established behavioral baseline and includes suspicious external communications inconsistent with authorized administrative operations.

D is incorrect: While the internal port connections could superficially resemble reconnaissance, this behavior originates from an already-compromised internal server rather than an external attacker performing initial scanning. The simultaneous outbound encoded payloads indicate an established C2 channel, which occurs after initial access has been achieved, placing this activity in later attack stages.