Quiz 4

In a network traffic classifier, logistic regression gives an output of 0.49 for one sample and 0.91 for another. Which interpretation is most appropriate?

• Both samples are benign because outputs are below one

• The first is near the boundary while the second is strongly attack

• The first is incorrect because logistic regression cannot return decimals

• The second is invalid because classification models must return labels only

A cybersecurity team replaces logistic regression with random forest for malware detection. What is the strongest reason for expecting better performance on complex patterns?

• Random forest combines diverse trees that capture more complicated decision boundaries

• Random forest always uses fewer computations than logistic regression models

• Random forest avoids using labeled data during the training process

• Random forest converts every feature into a continuous probability score

A decision tree chooses “Outlook” as the first split in a weather dataset. What does this most likely imply?

• Outlook has the smallest number of values among all features

• Outlook gives the highest class separation according to the split criterion

• Outlook was manually selected before the algorithm started training

• Outlook has the greatest correlation with every other feature present

A single decision tree performs very well on training data but poorly on test data. Why might random forest improve the result?

• It reduces overfitting by averaging decisions from multiple varied trees

• It removes the need for feature selection in every dataset

• It ensures each tree learns the complete dataset without sampling

• It converts the classification task into a regression problem

In a random forest spam classifier, five trees vote as follows: Spam, Spam, Not Spam, Spam, Not Spam, Spam. Why is the final prediction Spam?

• Spam appears first in the list of predictions from trees

• Spam receives the majority of votes among all the trees

• Random forest always favors the positive class during voting

• The first three trees have higher weight than the last two

A dataset is perfectly separable by a straight line in two dimensions. Which SVM design is most justified?

• Nonlinear SVM because all datasets benefit from kernel mapping

• Linear SVM because a maximum-margin straight boundary is sufficient

• Random forest because SVM cannot handle two-dimensional data

• Logistic regression because hyperplanes are only used in regression

An SVM model performs poorly on circularly distributed classes. What is the most logical adjustment?

• Use a kernel-based nonlinear SVM to transform the feature space

• Reduce the number of support vectors before retraining the model

• Replace all class labels with probabilities before training again

• Remove the training points closest to the current boundary

Why are support vectors especially important in SVM classification?

• They store all training samples used during the fitting process

• They are the nearest points that determine the boundary location

• They are the only points correctly classified by the model

• They are hidden neurons that apply the kernel operation

Which scenario best explains why logistic regression may fail while SVM with kernel succeeds?

• When the input has missing values in all observations

• When the classes require a nonlinear boundary for separation

• When the output labels are already encoded as zeros and ones

• When the dataset contains fewer features than training samples

A classifier labels attack traffic as 1 and benign traffic as 0. Why is sigmoid suitable in logistic regression for this task?

• It converts weighted sums into values interpretable as class probabilities

• It guarantees that all misclassified samples are corrected immediately

• It removes the need for any optimization during model training

• It transforms a categorical target into a continuous feature vector