At a hospital, a beacon had been calling out for 20 days before the first alert, and nobody has isolated the host. That gap is observed for this case and is not a published target. Which SOC metric is long, and what does that length do to the investigation?
Select an answer to reveal the explanation.
Short Explanation
A smoke alarm that rings long after the fire leaves you a wide kitchen to search. You have a long time to detect, so the investigation window is wide, and those 20 days describe this hospital rather than a target. The trap is containment that has not started, a vulnerability score, or a cipher suite.
Full Explanation
Time to detect runs from the start of the malicious activity to the first alert. Here the beacon was already calling for 20 days before that alert, so detection was late and the activity window to investigate is wide. Isolation has not happened, so containment has not been measured. The 20 days describe this hospital only. "Time to detect is long, so the investigation must cover a wide window of host activity" is the metric and its effect on scope. "Time to contain, a clock that has not started while the host is still unisolated" is the wrong clock because nobody has isolated the host. "A CVSS score for the beacon, used here as if it were the SOC detection clock" is a vulnerability rating, not a SOC timer. "The cipher suite on the beacon session, used as if it measured detection delay" is an algorithm label, not a duration. Exam caveat: do not treat 20 days as a standard target or an industry average. Operational check: mark the first beacon timestamp and the first alert timestamp, then collect evidence across that whole interval. Include the days before the alert.