GIAC GMLE Certification Sample Questions
The purpose of this Sample Question Set is to provide you with information about the GIAC Machine Learning Engineer (GMLE) exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the GMLE certification test. To get familiar with real exam environment, we suggest you try our Sample GIAC GMLE Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual GIAC Machine Learning Engineer (GMLE) certification exam.
These sample questions are simple and basic questions that represent likeness to the real GIAC Machine Learning Engineer exam questions. To assess your readiness and performance with real-time scenario based questions, we suggest you prepare with our Premium GIAC GMLE Certification Practice Exam. When you solve real time scenario based questions practically, you come across many difficulties that give you an opportunity to improve.
GIAC GMLE Sample Questions:
01. DBSCAN is run over connection records drawn from two network segments. With a small neighbourhood radius the busy internal segment forms sensible clusters while nearly every DMZ record is marked noise; with a larger radius the DMZ records cluster but the whole internal segment merges into one group.
What does this behavior indicate?
a) The number of clusters is being inferred rather than supplied, which makes the result unstable.
b) The two segments have different point densities, and a single density threshold cannot suit both at once.
c) The records were not standardized, so one feature dominates the neighbourhood distance.
d) The radius is being swept in the wrong direction, and values between the two extremes will resolve both segments.
02. An analyst plots outbound session sizes for a week. Most sessions carry a few kilobytes, while a small number run to hundreds of megabytes, and the histogram shows a long tail stretching to the right.
What does that shape imply about the mean and the median session size?
a) The median sits above the mean, because a few very large sessions raise the middle of the ordered list faster than they raise the average.
b) The mean sits above the median only when the largest sessions exceed three standard deviations, and stays level below that.
c) The mean sits above the median, because the long tail pulls the average upward while the median stays among the many small sessions.
d) The mean and the median coincide, because both are computed from the same set of observations.
03. Hunting across a month of proxy logs, an analyst computes the Pearson correlation between hour of day, numbered 0 to 23, and connection volume, and gets 0.02. A histogram of volume by hour shows two clear peaks, one around 09:00 and another around 21:00, with much lower volume in the middle of the afternoon and overnight.
What does the near-zero coefficient establish here?
a) Very little: the coefficient measures straight-line association, and a pattern that climbs to a peak, falls away and climbs again produces slopes of both signs that cancel out.
b) Connection volume varies too little across the month for any coefficient to move away from zero.
c) Hour of day and connection volume are independent of one another, so hour of day should be dropped from the hunt.
d) The sample is too small for a coefficient computed over twenty-four hourly buckets to carry any weight.
04. A weekly report notes that over the past six months the number of failed logons per day and the number of alerts raised per day have a correlation of 0.85. A manager proposes rolling out a password manager to cut failed logons, on the grounds that alert volume will fall by a similar proportion.
How should the analyst judge that proposal on the evidence given?
a) The coefficient supports it, because 0.85 is a strong correlation and a strong correlation is what justifies an operational change.
b) The coefficient cannot be read at all until the two counts are placed on a common scale, since one is far larger than the other.
c) The coefficient understates it, because a correlation over daily counts is diluted by quiet weekends and the underlying relationship is stronger.
d) The coefficient does not support it: a correlation states that two counts move together, not that one drives the other, and a busy weekday can raise both.
05. Six months of proxy logs are labeled for command-and-control beaconing. Most of the positive examples come from two campaigns that were active in weeks 9 to 14. The model will be deployed to score traffic captured after the log window closes, and the team plans an 80/20 random row split.
How should the split be constructed instead?
a) Cut the logs at a point in time, train on everything before that point and evaluate on everything after.
b) Draw a stratified random split, holding beaconing sessions to the same share of the training and the evaluation parts.
c) Keep every session from a given client host inside a single part, so no host appears in both.
d) Shuffle the rows and repeat the random split several times, averaging the score across the repetitions.
06. Flow records are collected with one-in-1,000 packet sampling. The team plans to use them to detect low-and-slow data exfiltration, which shows up as small, infrequent transfers spread over several days.
What does the sampling rate most directly mean for this dataset?
a) Large, long-lived flows are the ones most likely to be lost, since sampling favors short connections.
b) Storage and processing costs fall while the relative shape of each flow is preserved as it was.
c) Flows carrying only a few packets may contribute no sampled packet at all, so those events go missing entirely.
d) Every flow is still recorded, but its byte counts are one-thousandth of the true figure and must be scaled back up.
07. A fleet baseline for daily outbound volume per host has a mean of 0.6 GB and a standard deviation of 0.2 GB, and the distribution is roughly symmetric. Yesterday one host moved 1.4 GB.
How many standard deviations above the baseline mean is that host's day?
a) 4.0
b) 7.0
c) 2.0
d) 0.8
08. Authentication events arrive from two collectors. One writes timestamps as local time with daylight saving in force and transfer sizes in kilobytes; the other writes epoch seconds in UTC and sizes in bytes. The team wants a single table in which each user's events can be ordered and totaled.
What has to happen before the two feeds are combined?
a) Deduplicate the combined table, removing the second copy of any event seen by both collectors.
b) Impute the columns that only one feed carries so both tables present the same set of fields.
c) Standardize the numeric columns to zero mean and unit variance so the two feeds are on a comparable scale.
d) Convert both timestamp columns to one time base and restate both size columns in one unit so that ordering and totaling operate on comparable values.
09. Endpoint telemetry carries a parent_process field that is empty in about 12% of rows. Investigation shows it is empty precisely when the process was started by a mechanism the agent cannot observe, and those rows are enriched for the behavior the team is trying to detect.
How should the field be prepared for training?
a) Fill the field with the parent process that occurs most often elsewhere in the data.
b) Drop the column, because a field missing for a systematic reason cannot be modeled.
c) Impute the field and add an indicator column recording that the original value was absent.
d) Drop the rows carrying the empty field, since 12% is a small enough share of the data to lose.
10. Malicious binaries are roughly one in 5,000 of the samples in a submission database. To build a classifier the team pulls an extract containing equal numbers of malicious and benign files, divides it in two, and reports precision of 0.93 on the held-out half.
What is the most important change to make before that figure is quoted to the SOC?
a) Rebalance the training extract to the production proportion so the model is fitted on the class mix it will meet.
b) Rebuild the evaluation half at the prevalence the model will meet in production, because precision measured on a balanced sample does not carry over to a one-in-5,000 base rate.
c) Draw a larger balanced extract so that the precision estimate carries a narrower confidence interval.
d) Report the area under the ROC curve, which is computed from rates within each class rather than from the mix.
Answers:
|
Question: 01 Answer: b |
Question: 02 Answer: c |
Question: 03 Answer: a |
Question: 04 Answer: d |
Question: 05 Answer: a |
|
Question: 06 Answer: c |
Question: 07 Answer: a |
Question: 08 Answer: d |
Question: 09 Answer: c |
Question: 10 Answer: b |
Note: For any error in GIAC Machine Learning Engineer (GMLE) certification exam sample questions, please update us by writing an email on feedback@edusum.com.
