A hospital SOAR record says a playbook disabled a clinician account, but the directory still lists that same account as enabled. How should the analyst read the two records?
Select an answer to reveal the explanation.
Short Explanation
A checklist mark that says done is not the same as opening the drawer. You check the directory, because the recorded disable did not take effect. The trap is trusting the playbook line, blaming encryption, or blaming a certificate.
Full Explanation
The right selection is "The recorded disable did not take effect, so check the directory before treating the account as closed". The directory is where the account's enabled state actually lives. The playbook wrote a success line, and the directory still shows enabled, so the action did not change the account. The statement "The playbook line by itself is proof that the clinician account is already disabled" treats an automation note as the account state, and the directory contradicts that note. The statement "The clinician computer is encrypted, and that encryption hides the real account state" would affect files on a computer, and it does not explain an enabled flag in the directory. The statement "An expired hospital certificate turned the account back on after the playbook reported success" invents a cause the two records do not show; a certificate date is a different problem from an account that is still enabled. Exam caveat: the playbook line remains useful as a history of what was attempted, and it is not proof of the resulting account state. Operational check: open the directory entry for that clinician, read the enabled flag, and review the playbook result for an error if the flag is still enabled.