At a logistics hub, analysts acknowledged the alert quickly and isolated the host quickly, yet the warehouse system stayed unusable until the next day. Acknowledgment is the response clock and isolation is already done. Which metric covers the last wait until operations were under control?
Select an answer to reveal the explanation.
Short Explanation
Answering the radio and shutting the dock door still leaves the warehouse dark. You already counted a quick acknowledgment and a quick isolation, so the last wait is time to control. The trap is calling that wait detection, response, or a listening-port count.
Full Explanation
The stem separates three moments. The alert was noticed and acknowledged quickly, which is the response clock in this scenario. Isolation also happened quickly. The warehouse system still stayed unusable until the next day, so the remaining wait is the time until the incident was actually under control. "Time to control, the wait until the warehouse incident was actually brought under control" covers that last wait. "Time to detect, the gap before anyone noticed the alert on the warehouse system" ended when the alert was noticed, which was quick. "Time to respond, counted here as the quick acknowledgment that the alert was seen" is the acknowledgment, and the stem already says that step was fast. "A listening-port count from the warehouse server profile, a host field and not a SOC timing metric" is a server-profile field, not a clock. Exam caveat: time to respond here is the acknowledgment, and time to control is the later return of usable operations. Operational check: log acknowledgment time, isolation time, and the time the warehouse system was usable again, and assign the last gap to control.