A housing-authority purple team notices an AI agent reported a CVE that does not appear in the raw scanner output. What should the team do first?
Select an answer to reveal the explanation.
Short Explanation
Think of the AI as a helpful intern summarizing the scanner binder—not as the scanner itself. If the CVE is not in the raw output, humans need to catch that before anyone opens a ticket. Trust-but-verify beats trust-the-chatbot.
Full Explanation
In a housing-authority purple-team workflow, an AI agent that contextualizes scanner output is an assistive layer, not a primary source of vulnerability evidence. When the agent reports a CVE that does not appear in the raw scanner artifact, the correct first action is to validate the AI contextualization against that raw scan evidence before escalating. Doing so preserves chain of custody for municipal findings, prevents ticket noise from model hallucination, and keeps remediation owners focused on issues that scanners actually observed on authority-managed hosts.
Accepting the AI finding as authoritative because generative models rarely invent CVEs is conceptually wrong: large language models and agent summarizers do invent plausible CVE identifiers, plugin names, and severity narratives when prompts or retrieval miss the underlying scan rows. Rarity is not a control. Disabling the scanner and relying only on the AI agent's vulnerability list going forward inverts the evidence hierarchy—the scanner produces measurable probe results; the AI interprets them. Publishing a hallucinated CVE to the city patch board to force vendor attention wastes civic remediation capacity, damages credibility with vendors and IT owners, and may trigger unnecessary change windows on production housing systems.
Exam caveat: GOAA-style items often test whether candidates treat AI as a trusted oracle. The durable rule is trust-but-verify—AI may enrich, cluster, or draft narrative, but escalation must be grounded in scanner (or other sensor) evidence unless a separate authorized technique produced the finding.
Operational check: before opening or escalating a housing-authority ticket, require a side-by-side comparison of the AI claim against the scanner plugin output, host/port tuple, and detection timestamp; if the CVE is absent from raw results, quarantine the AI claim as unverified and investigate prompt/retrieval error rather than routing it to patch owners.