A county external scan finds exposed RDP on a temporary construction-trailer PC. How should an AI agent best support the investigation?

An external county scan that finds exposed RDP on a temporary construction-trailer PC creates an investigation and ownership problem more than an immediate exploit opportunity. The best AI support is drafting owner and IT follow-up questions from the scan finding for human investigators—who owns the trailer network path, why RDP is exposed, what compensating controls exist, and whether the host is still in scope. That keeps the agent inside authorized analysis and accelerates human response without exceeding ROE.

Auto-exploiting the RDP service and installing persistence for purple-team convenience is unauthorized offensive action unless explicitly chartered and controlled; it risks trailer and adjacent county systems and muddies evidence. Marking the finding closed because temporary trailers are out of scope by default invents a scope rule—temporary does not mean excluded unless ROE says so; construction networks often bridge to more sensitive county segments. Replacing the scanner report with a generative story that invents a different IP destroys forensic integrity and can send responders to the wrong asset.

Exam caveat: temporary, contractor, and trailer assets are classic municipal blind spots. GOAA items often test whether candidates close findings by convenience or investigate ownership and exposure with disciplined AI-assisted questioning.

Operational check: retain the original scan evidence, have the agent propose a short investigator checklist tied to that host/port, assign humans to confirm ownership in CMDB/procurement records, and only then decide containment, hardening, or formal exception.