A transit SOC uses generative AI to draft a believable badge-renewal phishing lure for an authorized drill. What step most improves quality while staying inside civic controls?
Select an answer to reveal the explanation.
Short Explanation
Let the model rough out the badge-renewal story, then a human conductor checks the tone, the claims, and the legal rails before anything rolls. Prompt craft helps; unsupervised send does not. Real PII does not belong in the prompt soup.
Full Explanation
When a transit SOC uses generative AI to draft a badge-renewal phishing lure for an authorized drill, quality and civic control both improve when prompt engineering is paired with mandatory human review of tone, facts, and legal boundaries before send. Prompt craft can increase realism—plausible subject lines, renewal framing, and urgency cues—but unsupervised model output can invent incorrect policies, over-aggressive threats, brand-unsafe wording, or sensitive details that should never appear in a municipal exercise. Shipping the first model draft to all operators without editing to preserve an ‘authentic AI tone’ prioritizes novelty over safety and accuracy. Disabling human review so prompt engineering alone defines legality and brand safety improperly treats prompting skill as a substitute for policy and legal gates. Pasting live employee badge numbers and home addresses into the prompt for maximum realism injects real PII into the generative workflow and creates unnecessary privacy exposure even before the mail is sent. Exam caveat: GOAA AI-phishing items reward the dual control of realism techniques plus human gatekeeping inside authorized civic drills—not raw model purity. Operational check: keep a human editor checklist for tone, factual claims, PII exclusion, and legal boundaries; block send until review is logged on the transit exercise ticket.