A water customer-portal purple team uses AI to propose parameter names to probe. Which control best keeps humans in the loop?
Select an answer to reveal the explanation.
Short Explanation
AI can toss parameter name ideas onto the table—you still check the hits yourself before crying vuln. Blind production spraying and 'the model said so' are how water portals get surprise outages.
Full Explanation
AI can propose parameter names to probe on a water customer portal, but humans must remain in the loop before escalation. The correct control requires manual verification of each notable AI-suggested probe hit—replaying, confirming behavior, and documenting evidence—before calling it a vulnerability or widening testing. That prevents model noise, false positives, and unsupervised production spray from driving utility operations risk, including metering and billing side effects.
Auto-firing every AI-proposed probe against production meters without review removes authorization gates and can disrupt metering or customer functions. Disabling logging so probes leave no audit trail destroys accountability and incident reconstruction for a regulated utility context. Treating every model suggestion as a confirmed vulnerability without replay elevates hallucination and coincidence to finding status.
Exam caveat: human-in-the-loop items reward manual verification of notable AI probe hits before escalation. Operational check: collect AI parameter ideas, run only approved probes, manually verify notable hits with logging enabled, compare against expected safe baselines, then escalate with evidence—not with raw model assertions.