A city SOC writes an operational-risk note that successful injection against the 311 bot could spam field crews. What skill does that note demonstrate?
Select an answer to reveal the explanation.
Short Explanation
Saying 'injection could bury field crews in junk tickets' turns a geeky finding into something ops can feel. That's the point—tie prompt risk to real civic blast radius.
Full Explanation
An operational-risk note stating that successful injection against the 311 bot could spam field crews demonstrates the skill of linking prompt-exploitation findings to concrete municipal operational consequences. Technical classes become decision-useful when they describe blast radius in city terms: ticket floods, wasted crew time, delayed legitimate resident requests, or degraded trust in the service desk. That linkage is core AI threat profiling for civic SOC practice. Whether the chatbot can be prompted to disclose dispatch protocols describes a separate information-disclosure finding, not the skill of translating an injection finding into an operational-impact statement. Measuring refusal rates for disallowed content in routine 311 dialogues is a safety-metrics task, not the skill of translating an injection finding into an operational-impact statement. Auditing training data provenance for municipal records compliance policy is a data-governance task, not a demonstration of linking prompt findings to municipal consequences. Exam caveat: consequence narratives should be grounded in plausible abuse of the tested system under authorization—not speculative catastrophe unrelated to the bot's actual permissions. Operational check: for each high-severity injection finding, record affected workflows (work-order creation, dispatch notes), estimate volume or delay impact, name the owning department, and verify whether rate limits, human approval gates, or tool allow-lists would contain a spam-the-crews scenario.