Unit 4 assessment — AI in the SOC, governance and agent evaluation
Using AI on the defensive side without trusting it blindly: hallucinated indicators, an autonomous responder that needs a leash, incident command when the AI system is the incident, and measuring an agent's trajectory rather than its confidence.
6 questions drawn from a bank of 9, in their own order with the options moved. Take it again and you sit a different paper.
0 of 6 answered
1. An AI assistant in the SOC speeds up triage but analysts stop reading the source logs. What is the risk?
Tests: Automation bias
2. Why must conversation and trace logs be preserved during an AI incident?
Tests: Evidence preservation
3. A governance review asks 'what is this AI system allowed to do?'. Which artifact answers it?
Tests: Governance artifacts
4. What is the minimum leash for an autonomous responder that can isolate hosts?
Tests: Bounding autonomous response
5. Which measure best describes an agent's performance on an evaluation range?
Tests: Agent evaluation
6. The AI system itself is the incident — the assistant leaked data through a tool. What is the first containment step?
Tests: AI incident command