Appropriate SOC Use for an AI Agent That Searches the Web and Calls SOAR

CY0-001 By islever Editorial Last updated

Given a scenario, use AI-enabled tools to facilitate security tasks.

Short answer

B Use the AI agent for OSINT research and alert enrichment, because web-search context reduces case resolution time without exposing enterprise uptime to autonomous containment.

Question

A security operations center (SOC) team has an AI agent that performs web searches and calls to the Security Orchestration, Automation, and Response (SOAR) solution. The team is concerned about enterprise uptime and case resolution time. Which of the following is the most appropriate use of the AI agent?
  1. To analyze and contain offending users or hosts using SOAR playbooks
  2. To perform research using open-source intelligence to enrich the alerts Correct Answer
  3. To aggregate SOC metrics and generate reports for the leadership team
  4. To create tabletop exercises so the team can increase its incident response (IR) speed

Key Takeaways

The exam tests whether you can separate AI-assisted research from autonomous SOAR containment, and the main trap is assuming that SOAR playbook access justifies letting the agent contain users or hosts.

This CY0-001 scenario asks SOC leaders to choose the safest, highest-value use of an AI agent with web-search and SOAR access. The answer is B: OSINT research and alert enrichment, not automated containment.

Common mistake: The most plausible wrong answer is A: using SOAR playbooks to analyze and contain offending users or hosts. It is wrong because autonomous containment can take critical systems offline on a false positive, directly threatening the uptime constraint that the stem emphasizes.

Expert Analysis

Why option A sounds right The AI agent can call SOAR, and SOAR playbooks are built to analyze and contain users or hosts. That makes A feel like the natural "action" answer: it uses both listed capabilities, and containment can shorten incident response by removing a threat quickly. It also appears to address case resolution time, because an agent that contains a host can close a case faster than a human-driven investigation.

Where A stops being correct The stem pairs case resolution with enterprise uptime. An AI agent that autonomously contains users or hosts can take business-critical systems or accounts offline based on a false positive, incomplete context, or a poorly scoped playbook. That is a direct availability risk, and the scenario gives no human-approval guardrail. Comments on this question make the same point: automated containment without a human in the loop could hurt uptime, while OSINT research saves analyst time without introducing that operational risk.

Why B fits both constraints The agent's web-search capability is ideal for open-source intelligence research and alert enrichment. It can gather threat intelligence, indicator reputation, vulnerability data, and attack context, then pass that context into the SOAR case or ticket. This reduces manual research and speeds case resolution without granting the agent authority to disrupt production. It also uses SOAR as a workflow sink rather than an autonomous enforcement tool.

Why not C or D Aggregating SOC metrics and generating leadership reports is useful but does not explain why the agent needs web search and SOAR access. Tabletop exercises may improve IR readiness, but they are not a live case-resolution workflow. The most appropriate use is B: OSINT research to enrich alerts.

Official Reference

https://www.nist.gov/itl/ai-risk-management-framework

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a stem adds a capability such as web search or SOAR access, match the option to the least disruptive way that capability supports the stated SOC goal. Eliminate any option that grants an autonomous agent containment or remediation authority without explicit human approval, because exam scenarios treat uptime and safety as constraints. Then ask whether the remaining option directly improves case resolution; OSINT enrichment does, while reporting and tabletop exercises do not exercise the same agent path.

Frequently Asked Questions

Why is OSINT enrichment safer than using the AI agent to contain hosts or users?

Containment changes production access and can interrupt business services if the agent acts on a false positive, which directly threatens enterprise uptime. OSINT enrichment is read-only research that gives analysts context while keeping remediation under human approval.

Does SOAR access make automated containment the best use of the AI agent?

No. SOAR can execute containment playbooks, but the question pairs that capability with a concern for uptime and resolution time. The safer answer is to use the agent's web-search capability for alert enrichment rather than grant it autonomous containment authority.

How does OSINT enrichment improve case resolution time?

It quickly adds threat intelligence, indicator reputation, vulnerability details, and attack context to alerts, so analysts spend less time on manual research and can prioritize and investigate cases faster.

More CY0-001 FAQ →

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. jahute27 👍 3 Answered B
    To perform research using open-source intelligence to enrich the alerts The key concern is enterprise uptime and case resolution time. An AI agent that performs web searches is ideally suited to gathering open-source intelligence (OSINT) and enriching alerts with threat intelligence, reputation data, indicators of compromise (IOCs), vulnerability information, and attack context. This helps SOC analysts investigate incidents faster and improve mean time to resolution (MTTR) while reducing the risk of disrupting business operations.
  2. Comptia SecAI Group 👍 1 Answered B
    An AI model automatically containing users and hosts without a human in the loop could definitely have negative impact on downtime. Automated OSINT research can save the analysts lots of time while not presenting any unnecessary risk.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Protecting an AI System from Denial-of-Wallet Attacks

S-grade

Why did the chatbot give wrong worm-removal steps?

S-grade

Facial Recognition as Neural-Network Authentication

S-grade

Detecting Attacks Across an LLM Firewall

S-grade

← Back to CY0-001 Study Guide