The SOC must sequence AI reconnaissance across many municipal bots. Which prioritization best reflects offensive AI security judgment?
Select an answer to reveal the explanation.
Short Explanation
Recon the bot that can dispatch trucks before the one that only quotes park hours—blast radius beats raw query volume. Civic impact should set the queue.
Full Explanation
When the SOC must sequence AI reconnaissance across many municipal bots, offensive AI security judgment prioritizes systems that can create or change field-work tickets over low-impact FAQ-only bots. Agents that mutate tickets, permits, or dispatch work have larger civic blast radius if steered or abused; recon depth and earlier scheduling should follow that impact so limited purple-team time reduces the highest resident and operations harm first. FAQ bots still matter for integrity and disclosure risks but usually rank lower when resources are finite and write-capable agents remain unmapped.
Prioritizing bots with highest citizen query volume over rarely used department assistants fails conceptually: raw query volume ignores operational consequence and can schedule a heavily used park-hours FAQ ahead of a rarely used but write-capable work-order agent. Prioritizing bots supporting the widest language coverage over single-language pilot projects fails because language breadth is not a risk driver for civic service abuse. Stating that bot functionality and language are independent of security posture, so all systems require assessment, is true as a baseline but fails to answer the sequencing question—on finite SOC time, some order is still required, and this choice provides no impact-based prioritization scheme at all.
Exam caveat: Prioritization stems reward blast-radius / workflow-mutation ranking over query-volume, language-coverage, or baseline-assessment ordering. Prefer ticket- and field-work mutation capability when the stem asks how to sequence many municipal bots.
Operational check: score each bot for write/actions capability, data sensitivity, and resident impact; queue ticket-mutating agents first for authorized recon; document residual risk acceptance for deferred FAQ bots until higher-impact systems are mapped; and revisit priority when a FAQ bot gains new plugins that can change tickets.