A school SOC designs a pipeline that combines network scanning with an AI agent. Which sequence best reflects sound municipal operations?
Select an answer to reveal the explanation.
Short Explanation
Map the network, scan for weaknesses, let AI draft the story, let a human check it, then open tickets. Summarizing before you have data—or ticketing ghosts—is school-district chaos.
Full Explanation
A school SOC pipeline that combines network scanning with an AI agent should follow evidence-first municipal operations: enumerate, vulnerability-scan, AI-summarize, human-verify, then ticket. Enumeration builds the asset/service map; vulnerability scanning attaches weakness evidence; AI drafts clustering and narrative; humans verify accuracy and scope; ticketing assigns work. That order prevents the district from funding remediation of stories that lack scan backing.
Summarizing with AI first, ticketing immediately, then enumerating and vuln-scanning last inverts the pipeline and creates tickets before evidence exists. Ticketing before any scanning so metrics look complete, then inventing findings with AI, is metric fraud and unsafe for school environments. Skipping human verification whenever the AI summary is longer than one page treats verbosity as validation—length is not correctness.
Exam caveat: GOAA-relevant practice integrates AI after real scan artifacts exist. Sequence questions test whether candidates put generative steps after sensors and before or with human gates—not instead of them.
Operational check: enforce pipeline stages in the SOC workflow tool (no ticket without linked scan evidence IDs), require a human verification checkbox before assignment, and sample weekly for tickets that skipped enumeration or verification.