The change advisory board receives a thick week of firewall change logs and asks for a readable packet. Which AI-assisted security task should the SOC apply?

AI summarization condenses lengthy firewall change logs into a readable packet so the municipal change advisory board can focus on risk themes, outliers, and exceptions without reading every hit-counter line before a vote. Source logs must remain available; the summary is an aid for reviewers, not a replacement for evidence or for human approval of security-relevant changes.

Classification that condenses lengthy security operations logs for reviewers fails because classification assigns labels or categories to entries; it does not condense a week's logs into a readable packet, which is summarization. Clustering that condenses lengthy security operations logs for reviewers fails because clustering groups similar events to reveal patterns; it does not distill them into one readable summary for a board vote. Anomaly detection that condenses lengthy security operations logs for reviewers fails because anomaly detection flags unusual changes for investigation; it does not condense the full week of logs into the requested packet.

Exam caveat: when the stem asks how AI helps reviewers digest thick ops logs into one readable packet, summarization is the task—classification, clustering, and anomaly detection do not condense logs into a brief even when the option text claims they condense lengthy security operations logs for reviewers.

Operational check: retain immutable originals, label AI summaries as non-authoritative, require CAB or change-owner sign-off on high-risk firewall diffs, and verify that classification, clustering, or anomaly detection tools stay supplementary to the summarized packet because they do not produce the condensed reviewer packet.