Free GMLE Practice Questions

Question 1

Minutes after a parser release, an isolation control driven by autoencoder reconstruction error starts disconnecting healthy production hosts. Feed A now reports durations in milliseconds, but its fitted scaler and model expect seconds; replay confirms that this unit change causes the false isolations. Feed B has a separate model and preprocessing, both verified unchanged and valid. The two feeds can trigger isolation independently. What should the on-call engineer change first?

Accepted Answer

Pause feed A's isolation action and verify the unit correction before restoring it.

Answer

Raise both anomaly thresholds until the isolation rate returns to its previous level.

Answer

Pause isolation from both feeds and retrain both models before either resumes.

Answer

Continue isolation while refitting feed A's scaler on the newly received durations.

Question 2

Two RBF support-vector classifiers use the same standardized telemetry, the same training and test sets, and C = 1. Raising gamma from 0.02 to 20 improves training accuracy but reduces test accuracy. The new decision surface has small isolated regions around training examples. This change is explained by:

Accepted Answer

Narrower influence around each support vector, permitting more localized decision regions.

Answer

Wider influence around each support vector, blending observations over greater distances.

Answer

A weaker penalty on margin violations, while the kernel's spatial influence remains unchanged.

Answer

A higher polynomial degree in the kernel, introducing additional powers of the input features.

Question 3

An enrichment query must retain every event exactly once, attaching 'high' only when the source IP has a high-risk intelligence record and NULL otherwise. The events table has one row per event. The intel table has at most one row per src_ip, with risk either 'high' or 'low'. Some events match high-risk records, some match low-risk records, and others have no match. Select the query that preserves all three groups.

Accepted Answer

SELECT e.event_id, i.risk FROM events AS e LEFT JOIN intel AS i ON e.src_ip = i.src_ip AND i.risk = 'high';

Answer

SELECT e.event_id, i.risk FROM events AS e LEFT JOIN intel AS i ON e.src_ip = i.src_ip WHERE i.risk = 'high' OR i.src_ip IS NULL;

Answer

SELECT e.event_id, i.risk FROM events AS e INNER JOIN intel AS i ON e.src_ip = i.src_ip AND i.risk = 'high';

Answer

SELECT e.event_id, i.risk FROM events AS e LEFT JOIN intel AS i ON e.src_ip = i.src_ip WHERE i.risk <> 'low';

Question 4

A detector is deployed where 1% of hosts are compromised. At its operating threshold, it alerts on 95% of compromised hosts and 2% of uncompromised hosts. These rates apply to the deployment population. Policy permits automatic containment only when the probability of compromise exceeds 50%; other alerts go to an analyst. A host generates a positive alert with no additional evidence. Which routing decision and probability estimate are consistent with the evidence?

Accepted Answer

Send the alert to an analyst; the probability of compromise is approximately 32%.

Answer

Automatically contain the host; a positive result gives approximately 95% probability of compromise.

Answer

Automatically contain the host; the false-positive rate implies approximately 98% probability of compromise.

Answer

Send the alert to an analyst; the probability of compromise remains approximately 1%.

Question 5

A host-monitoring model reports scanning, unusual data transfer, and repeated authentication failures. Each finding has its own 0/1 target, and any combination may occur in the same host-hour. The output must provide a probability for each finding. How should the output layer and loss be configured?

Accepted Answer

Three sigmoid outputs with binary cross-entropy on probabilities.

Answer

Three softmax outputs with categorical cross-entropy on probabilities.

Answer

Three sigmoid outputs with sparse categorical cross-entropy on probabilities.

Answer

Three linear outputs with mean squared error on the target values.

Question 6

In a scikit-learn DBSCAN result using unweighted observations, the core points form two disconnected groups: no chain of core-to-core steps within eps connects them. A non-core point z lies within eps of a core point in each group. If the rows are processed in a different order, which property is preserved?

Accepted Answer

Point z joins exactly one group; the core groups stay separate.

Answer

Point z belongs to both groups, merging them into a single cluster.

Answer

Point z becomes core because it neighbors core points in both groups.

Answer

Point z becomes noise because more than one cluster can reach it.

Question 7

An engineer edits two NumPy subsets while preparing features from a raw flow array. Trace the following assignments:

import numpy as np
flows = np.array([[5, 50], [7, 70], [9, 90]])
durations = flows[:, 1]
sample = flows[[0, 2], :]
durations[0] = -1
sample[1, 0] = 0

What is flows.tolist() after both edits?

Accepted Answer

[[5, -1], [7, 70], [9, 90]]

Answer

[[5, -1], [7, 70], [0, 90]]

Answer

[[5, 50], [7, 70], [9, 90]]

Answer

[[5, 50], [7, 70], [0, 90]]

Question 8

Most transfers in a month's records are small, but a few scheduled backups are extremely large. The backup values have been verified as accurate and legitimate. A report needs both a description of a typical transfer and the full month's aggregate volume. Which combination keeps those two purposes distinct?

Accepted Answer

Use the median and interquartile range for typical transfers; use the mean times the transfer count for aggregate volume.

Answer

Use the mean and standard deviation for typical transfers; use the median times the transfer count for aggregate volume.

Answer

Use the median and interquartile range for typical transfers; estimate aggregate volume after excluding the largest valid transfers.

Answer

Use the mean and range for typical transfers; estimate aggregate volume after replacing the largest values with the median.

Question 9

A log-classification model receives 40 token vectors per log, each with 16 features, in channels-last order. It applies Conv1D with 32 filters, kernel width 3, stride 1, dilation 1 and valid padding, followed by GlobalMaxPooling1D over the token axis with keepdims=False. The dense classifier therefore receives:

Accepted Answer

32 features

Answer

16 features

Answer

38 features

Answer

1,216 features

Question 10

For a sandbox execution-time regressor, a held-out set of verified benign programs shows residuals centered near zero throughout the predicted-time range. Their spread, however, increases substantially for longer predicted runs. A single absolute-residual cutoff flags a much larger fraction of long-running programs. Which diagnosis best accounts for the uneven false-alert rate?

Accepted Answer

Heteroscedasticity; equal-sized residuals need not be equally unusual across the prediction range.

Answer

Systematic underprediction; a common intercept correction should remove the extra alerts.

Answer

Unmodeled curvature; a quadratic term is needed to correct the conditional residual mean.

Answer

Serial correlation; the execution-time pattern establishes dependence between successive residuals.

Free GMLE Practice Questions

Domain 1: Anomaly Detection and Optimization

Question 1

Domain 2: Clustering

Question 2

Domain 3: Convolutional Neural Networks

Question 3

Domain 4: Data Acquisition

Question 4

Domain 5: Leveraging Python

Question 5

Domain 6: Neural Networks

Question 6

Domain 7: Probability and Frequency

Question 7

Domain 8: Regressions

Question 8

Domain 9: Statistics Fundamentals

Question 9

Domain 10: Supervised Learning

Question 10

That's 10 of 1,030