At a bank, detection of a malicious host was fast, yet that host stayed on the network for a long time after the alert before anyone isolated it. Which metric explains the extra risk that the activity kept spreading?
Select an answer to reveal the explanation.
Short Explanation
You spotted the host quickly, but it stayed online while you waited to isolate it. Time to contain explains that exposure; time to detect was already short, time to control applies after containment and restoration, and patch compliance does not measure the isolation delay. You can focus on the interval that allowed the activity to keep spreading.
Full Explanation
Detection was fast, so the bank knew about the malicious host quickly. The host then stayed on the network until someone isolated it, leaving time for the activity to keep spreading. Time to contain measures that wait after the alert until isolation, so it explains the extra risk in this scenario. Time to detect measures how long it took to discover the activity; because detection was already fast, it does not describe the later period when the host remained online. Time to control refers here to an incident that has already been contained and then restored to service, steps that have not occurred in the scenario. A patch-compliance figure is a maintenance metric: it measures patching, not the time until the host was isolated. Exam caveat: time to contain and time to control are different clocks, and this scenario ends at isolation rather than restoration. Practical check: subtract the alert time from the isolation time, then review that interval for evidence that the activity spread further.