WGU E026 TASK 1 - AI FOR IT
AUTOMATION AND SECURITY
PERFORMANCE ASSESSMENT |
LATEST MOCK PRACTICE SET
150 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E026 TASK 1 - AI FOR IT AUTOMATION AND SECURITY PERFORMANCE ASSESSMENT | GNS3
HYBRID NETWORK, AI/ML MODELS, MITRE ATT&CK & SOAR PLAYBOOK | 2026 UPDATE.. It contains 150
carefully selected questions that reflect the most current exam content and testing strategies. Each question is
accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 150 Questions
Foundations - Application - WGU E026 TASK 1 AI FOR IT Automation AND Security Performance
Assessment GNS3 Hybrid Network Ai/ml Models Mitre Att&ck & SOAR Playbook 2026 Update AI FOR IT
Automation AND Security GNS3 Ai/ml Mitre Att&ck SOAR Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Network Design AND 1-25 Network, Playbook, Model, Traffic, Detection
Implementation WITH GNS3
Ai/ml Model Development 26-50 Playbook, Model, Network, Security, Automatically
AND Integration
Security Automation AND 51-75 Playbook, Network, Physical, Hybrid, Model
Orchestration
Mitre Att&ck Framework 76-100 Network, Playbook, Hybrid, Model, Mitre ATT
Application
SOAR Playbook 101-125 Network, Playbook, Model, Hybrid, Detection
Development AND Execution
Threat Detection AND 126-150 Model, Playbook, Network, Detection, Security
Response
TOTAL 150 All questions include answers and detailed rationales
,Section A - Network Design AND Implementation WITH
GNS3
Q1.
In a GNS3 hybrid network combining physical appliances and virtual instances, which
design choice ensures that AI-driven anomaly detection can inspect traffic without
becoming a single point of failure?
A. Deploy the detection sensor as a virtual B. Use a network tap that mirrors traffic to a
machine on the same hypervisor as the dedicated AI analysis cluster with failover
network controller
C. Place the sensor inline at the core switch D. Configure the sensor to receive only
with no bypass mechanism NetFlow summaries from edge routers
Correct: B - Use a network tap that mirrors traffic to a dedicated AI analysis cluster with
failover
Rationale:A dedicated tap with failover provides full visibility without inline disruption. Inline
sensors create a failure point unless bypass is implemented. Hypervisor co-location risks
resource contention. NetFlow summaries lose payload detail needed for deep AI analysis.
Q2.
When training a supervised ML classifier for network intrusion detection using a dataset
with extreme class imbalance (0.01% attack traffic), which metric best evaluates real-world
detection capability while accounting for both false positives and false negatives?
A. Accuracy B. F1-score
C. Recall D. Precision
Correct: B - F1-score
Rationale:F1-score is the harmonic mean of precision and recall, balancing both error types.
Accuracy is misleading due to imbalance. Recall alone ignores false positives. Precision
alone ignores false negatives. F1 provides a single metric that penalizes both.
Q3.
A threat actor uses PowerShell to download and execute a payload from a remote server.
Which MITRE ATT&CK technique and tactic pair best describes this behavior?
A. T1059.001 (Command and Scripting B. T1105 (Ingress Tool Transfer) under
Interpreter) under Execution Command and Control
Page 3
, Section A - Network Design AND Implementation WITH GNS3
C. T1055 (Process Injection) under Defense D. T1041 (Exfiltration Over C2 Channel)
Evasion under Exfiltration
Correct: A - T1059.001 (Command and Scripting Interpreter) under Execution
Rationale:PowerShell is a scripting interpreter (T1059.001) used to execute code—Execution
tactic. Ingress tool transfer (T1105) is for transferring tools to the victim, not the initial
execution. Process injection and exfiltration are different behaviors.
Q4.
In a SOAR playbook, after triage, an analyst wants to automatically contain a
compromised host without human approval. Which playbook design principle is most
critical to prevent unintended network-wide disruption?
A. Implementing a kill switch that allows B. Using a single automated action to block
manual override all outbound traffic
C. Running the playbook on every alert D. Hardcoding the host's IP address in the
regardless of severity playbook
Correct: A - Implementing a kill switch that allows manual override
Rationale:A kill switch provides a manual override to halt automated actions, limiting blast
radius. Blocking all traffic could disrupt legitimate services. Running on all alerts increases
false positives. Hardcoding IPs makes the playbook inflexible and error-prone.
Q5.
Which statistical property of a network traffic dataset most directly violates the
independent and identically distributed (i.i.d.) assumption in many ML models, thereby
degrading anomaly detection performance?
A. Temporal autocorrelation of traffic B. High dimensionality of feature vectors
features
C. Presence of categorical features D. Normalization of feature values
Correct: A - Temporal autocorrelation of traffic features
Rationale:Network traffic exhibits temporal correlations (e.g., bursts, periodic patterns),
violating i.i.d. High dimensionality and categorical features are issues but not i.i.d. violations.
Normalization is a preprocessing step, not a data property.
Q6.
In a GNS3 network, you simulate a ransomware attack that encrypts files and then
attempts to exfiltrate data. Which combination of MITRE ATT&CK tactics and techniques
should your SOAR playbook prioritize for automated detection and response?
Page 4
AUTOMATION AND SECURITY
PERFORMANCE ASSESSMENT |
LATEST MOCK PRACTICE SET
150 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E026 TASK 1 - AI FOR IT AUTOMATION AND SECURITY PERFORMANCE ASSESSMENT | GNS3
HYBRID NETWORK, AI/ML MODELS, MITRE ATT&CK & SOAR PLAYBOOK | 2026 UPDATE.. It contains 150
carefully selected questions that reflect the most current exam content and testing strategies. Each question is
accompanied by a correct answer and a detailed rationale that explains the underlying pathophysiology,
pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 150 Questions
Foundations - Application - WGU E026 TASK 1 AI FOR IT Automation AND Security Performance
Assessment GNS3 Hybrid Network Ai/ml Models Mitre Att&ck & SOAR Playbook 2026 Update AI FOR IT
Automation AND Security GNS3 Ai/ml Mitre Att&ck SOAR Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Network Design AND 1-25 Network, Playbook, Model, Traffic, Detection
Implementation WITH GNS3
Ai/ml Model Development 26-50 Playbook, Model, Network, Security, Automatically
AND Integration
Security Automation AND 51-75 Playbook, Network, Physical, Hybrid, Model
Orchestration
Mitre Att&ck Framework 76-100 Network, Playbook, Hybrid, Model, Mitre ATT
Application
SOAR Playbook 101-125 Network, Playbook, Model, Hybrid, Detection
Development AND Execution
Threat Detection AND 126-150 Model, Playbook, Network, Detection, Security
Response
TOTAL 150 All questions include answers and detailed rationales
,Section A - Network Design AND Implementation WITH
GNS3
Q1.
In a GNS3 hybrid network combining physical appliances and virtual instances, which
design choice ensures that AI-driven anomaly detection can inspect traffic without
becoming a single point of failure?
A. Deploy the detection sensor as a virtual B. Use a network tap that mirrors traffic to a
machine on the same hypervisor as the dedicated AI analysis cluster with failover
network controller
C. Place the sensor inline at the core switch D. Configure the sensor to receive only
with no bypass mechanism NetFlow summaries from edge routers
Correct: B - Use a network tap that mirrors traffic to a dedicated AI analysis cluster with
failover
Rationale:A dedicated tap with failover provides full visibility without inline disruption. Inline
sensors create a failure point unless bypass is implemented. Hypervisor co-location risks
resource contention. NetFlow summaries lose payload detail needed for deep AI analysis.
Q2.
When training a supervised ML classifier for network intrusion detection using a dataset
with extreme class imbalance (0.01% attack traffic), which metric best evaluates real-world
detection capability while accounting for both false positives and false negatives?
A. Accuracy B. F1-score
C. Recall D. Precision
Correct: B - F1-score
Rationale:F1-score is the harmonic mean of precision and recall, balancing both error types.
Accuracy is misleading due to imbalance. Recall alone ignores false positives. Precision
alone ignores false negatives. F1 provides a single metric that penalizes both.
Q3.
A threat actor uses PowerShell to download and execute a payload from a remote server.
Which MITRE ATT&CK technique and tactic pair best describes this behavior?
A. T1059.001 (Command and Scripting B. T1105 (Ingress Tool Transfer) under
Interpreter) under Execution Command and Control
Page 3
, Section A - Network Design AND Implementation WITH GNS3
C. T1055 (Process Injection) under Defense D. T1041 (Exfiltration Over C2 Channel)
Evasion under Exfiltration
Correct: A - T1059.001 (Command and Scripting Interpreter) under Execution
Rationale:PowerShell is a scripting interpreter (T1059.001) used to execute code—Execution
tactic. Ingress tool transfer (T1105) is for transferring tools to the victim, not the initial
execution. Process injection and exfiltration are different behaviors.
Q4.
In a SOAR playbook, after triage, an analyst wants to automatically contain a
compromised host without human approval. Which playbook design principle is most
critical to prevent unintended network-wide disruption?
A. Implementing a kill switch that allows B. Using a single automated action to block
manual override all outbound traffic
C. Running the playbook on every alert D. Hardcoding the host's IP address in the
regardless of severity playbook
Correct: A - Implementing a kill switch that allows manual override
Rationale:A kill switch provides a manual override to halt automated actions, limiting blast
radius. Blocking all traffic could disrupt legitimate services. Running on all alerts increases
false positives. Hardcoding IPs makes the playbook inflexible and error-prone.
Q5.
Which statistical property of a network traffic dataset most directly violates the
independent and identically distributed (i.i.d.) assumption in many ML models, thereby
degrading anomaly detection performance?
A. Temporal autocorrelation of traffic B. High dimensionality of feature vectors
features
C. Presence of categorical features D. Normalization of feature values
Correct: A - Temporal autocorrelation of traffic features
Rationale:Network traffic exhibits temporal correlations (e.g., bursts, periodic patterns),
violating i.i.d. High dimensionality and categorical features are issues but not i.i.d. violations.
Normalization is a preprocessing step, not a data property.
Q6.
In a GNS3 network, you simulate a ransomware attack that encrypts files and then
attempts to exfiltrate data. Which combination of MITRE ATT&CK tactics and techniques
should your SOAR playbook prioritize for automated detection and response?
Page 4
