Artificial Intelligence Fundamentals

GASAE · 20 questions

• A city SOC analyst wonders why an LLM summarizing tickets sometimes truncates long permit-system logs. Which AI text-processing limit best explains that behavior?
• A county IR team asks how tokenization affects searching rare hostnames in alert text. What connection should they understand?
• A transit fusion center compares keyword regex enrichment versus semantic similarity over ticket text. Which contrast is most accurate?
• A public-health SOC sees an LLM invent CVE IDs when given sparse malware notes. What risk does that illustrate?
• A court security team wants embeddings of procedure manuals for later retrieval, not free chat. Which approach matches that goal?
• A 311 security ops pilot wants an LLM to draft first-pass phishing ticket summaries so analysts can prioritize faster. Which use case best fits that municipal SOC need?
• A school-district SOC must triage noisy EDR notes and prefers terminology that matches detection playbooks. Which model choice best matches that defensive triage task?
• A water utility security team refuses to paste SCADA runbooks into a public LLM endpoint. What judgment does that decision correctly apply?
• A housing-authority SOC wants LLM-generated IR playbook drafts that stay close to approved procedures rather than inventing creative new steps. Which generative setting best supports that goal?
• A parks IT security team wants an LLM only to rewrite verbose SIEM alerts into fixed structured fields for a ticketing system. What role limitation best matches that design?
• A city detection engineer wants LLM detection suggestions grounded in the local Sigma and detection-rule git repository. Which approach best achieves that?
• A county SOC builds a vector index of past IR tickets so analysts can enrich new incidents with similar historical context. Which technique does that describe?
• A transit fusion-center team is indexing IR runbooks for RAG and debates how to split the documents. Which chunking approach best supports retrieving coherent municipal procedures?
• An emergency-management SOC requires every AI answer about response policy to show citations from retrieved municipal policies. What does that requirement enforce?
• A library IT security group configures RAG so the assistant may retrieve only from approved SharePoint security libraries. What control does that implement?
• A city security architect must label malware families from EDR features and separately draft narrative IR notes for stakeholders. Which model-type contrast is most accurate?
• A county purple team defines agentic AI for their lab as systems that plan steps, call tools, and iterate toward a goal. How does that differ from a single-shot LLM call?
• A public-works SOC wants an AI agent that can query SIEM APIs and then propose containment steps, but only after a human approves any action. Which design matches that requirement?
• A housing SOC refuses fully autonomous agents that can disable user accounts without a two-person rule. What principle does that apply?
• A city CISO asks how a multi-agent red/blue simulation differs from a single chat assistant. What contrast should the automation lead emphasize?