CISSP Practice Question (Domain 7: Security Operations / Incident Response + AI Context)

Rymar Tech’s SOC deploys a new AI-based anomaly detection system that suddenly begins generating an unusually high volume of high-risk alerts after being retrained with third-party data the previous night. No malicious activity has been confirmed, but the alert surge is overwhelming SOC analysts and impacting monitoring effectiveness.

What should the incident response manager do FIRST?

A. Disable the AI platform and revert to manual triage

B. Escalate to the CISO and declare a security incident

C. Initiate the incident response process beginning with detection and verification

D. Conduct a model validation review with the third-party integrator

13 comments