A county purple team exports Nmap XML from an approved scan and asks an AI agent to summarize likely exposed municipal services for human analysts. What Domain 7 practice does this illustrate?
Select an answer to reveal the explanation.
Short Explanation
Feed the scanner’s homework to the AI, then let humans grade the summary—that’s the workflow. County purple teams still trust Nmap XML more than freehand AI guesses. AI helps contextualize; it doesn’t get to rewrite the ROE.
Full Explanation
Domain 7 practice includes integrating structured vulnerability-scan outputs into AI-agent workflows so agents can contextualize exposed municipal services for human analysts—not so AI replaces scanners or rewrites authorization. When a county purple team exports Nmap XML from an approved scan and asks an AI agent to summarize likely exposed services for human review, that illustrates scan-to-agent contextualization with humans remaining accountable. Civic value comes from faster triage of real scan evidence while ROE and evidence grounding stay intact.
Replacing all vulnerability scanners with unverified AI guesses alone fails because models can hallucinate services and CVEs without packet-level evidence. Using deepfake audio to narrate port numbers to the help desk is irrelevant and unsafe as a scanning practice. Bypassing ROE because the AI agent requested broader subnets fails authorization; agents do not get to expand municipal scope.
Exam caveat: AI contextualization supplements scanners; it does not supersede approved scan data or ROE. Look for ‘human-reviewed’ as a signal of sound practice.
Operational check for county purple teams: feed only approved-scope Nmap (or similar) outputs, require analyst review before any remediation or follow-on testing, log that AI output is advisory, and reject agent suggestions that widen subnets, target forbidden systems, or drop the requirement for scanner-validated evidence.