Transit IT wants ongoing proof that SIEM detections fire for common attacker techniques against fare systems. Which control-testing approach fits best?
Select an answer to reveal the explanation.
Short Explanation
BAS is the fire drill that never stops—safe attack replays check whether the SIEM still wakes up. Tabletops alone, a one-off marketing phish, or turning detections off do not give that continuous proof.
Full Explanation
Breach-and-attack simulation (BAS) tools continuously (or frequently) replay known attacker techniques and measure whether detections and controls respond as expected. For transit fare systems, BAS provides ongoing proof that SIEM use cases fire for common techniques—credential abuse, lateral movement patterns, web shell behaviors—without waiting for a real incident. That continuous validation of detection outcomes is the control-testing approach that matches the stem’s demand for ongoing proof, complementing but differing from infrequent discussion exercises.
Annual tabletop discussions with no technical execution improve plans and communication but do not prove SIEM detections fire against live technique telemetry. Manual one-time phishing emails only to marketing are a narrow awareness check, not continuous detection validation across fare-system techniques. Disabling detections to reduce alert volume permanently destroys the control under test and increases dwell time.
Exam caveat: BAS is distinct from red teaming and from tabletops: it emphasizes automated, repeatable technique validation and detection measurement. When the question stresses continuous detection proof, BAS (or equivalent continuous control validation) is preferred over annual paper exercises.
Operational check: Map MITRE-style techniques relevant to fare systems into the BAS library, baseline which detections should fire, schedule recurring simulations, ticket missed detections to detection engineering, and report detection coverage trends to transit IT leadership as a KRI.