What are some use cases of AI-driven incident response?

• A. Detection and alerting, root cause analysis, incident resolution, and post-incident analysis.
• B. Data backup and archival only.
• C. Compliance reporting and policy generation.
• D. User account provisioning and access review.

Answer: (A)

AI-driven incident response shines by automating and accelerating the entire lifecycle of handling security events. It starts with detection and alerting, where AI continuously monitors many data sources, filters out noise, and surfaces real incidents quickly. It then supports root cause analysis by correlating indicators across systems to reveal what happened, how it spread, and which components were affected. For incident resolution, AI can run automated playbooks that contain containment, eradication, and recovery steps, orchestrating actions like isolating affected hosts or revoking compromised credentials. Finally, post-incident analysis uses AI to examine timelines and outcomes, identify gaps, and suggest improvements to prevention and response processes for the future. Other options don’t fit as well because data backup and archival are primarily about protecting data, not responding to incidents; compliance reporting and policy generation relate to governance, not real-time incident handling; and user provisioning and access reviews are IAM tasks, not incident-response workflows.