A city SOC wants an AI agent to help analysts see that many clerk-office findings share one underlying issue, such as outdated TLS. What task best matches that need?
Select an answer to reveal the explanation.
Short Explanation
Same broken lock on every clerk door is one root cause, not fifty unrelated mysteries. Let the agent group the shared pattern, then humans confirm. Inventing scores or forbidding clustering just wastes ticket queues.
Full Explanation
When a city SOC sees many clerk-office findings that share one underlying issue such as outdated TLS, the valuable AI task is clustering by shared root cause across sites. Clustering converts repetitive scanner noise into a single remediation theme—one protocol upgrade or configuration baseline—rather than dozens of near-duplicate tickets. Human analysts still confirm the pattern, but the agent accelerates pattern recognition across clerk locations that share common image or policy debt.
Replacing all scanner plugins with a single generative prompt that invents CVSS scores discards evidence-based detection and invents severity theater. Disabling clustering and opening one ticket per identical finding with no shared analysis maximizes busywork and hides the systemic fix municipal IT should fund. Deleting multi-site findings so each office only sees its own raw XML forever prevents cross-site learning and blocks citywide remediation planning.
Exam caveat: AI value in vulnerability operations is often aggregation, prioritization, and narrative—not replacement of scanners or deletion of inconvenient multi-site evidence. Prefer root-cause clustering with human confirmation.
Operational check: after clustering, sample clusters against raw plugin IDs and host lists; require that a citywide TLS remediation ticket cite the cluster definition and affected clerk sites, and keep per-host evidence attached for verification.