A parks department security lead wants scripts that replay known ransomware precursor behaviors in a lab VLAN. What automation practice best fits?

A parks department security lead who wants scripts replaying known ransomware precursor behaviors should automate that replay inside an isolated civic lab VLAN under change control. Lab isolation contains blast radius, automation makes results repeatable after detection changes, and change control keeps municipal operations informed. Precursor replay is for proving telemetry and detections—not for automating replay of modeled recovery workflows inside an isolated civic lab VLAN under change control, which validates restoration steps rather than proving detection of ransomware precursors.

Why the other options fail by concept: Automating replay of modeled recovery workflows inside an isolated civic lab VLAN under change control tests recovery and restoration rather than proving telemetry and detections for known ransomware precursors. Automating replay of raw production telemetry inside an isolated civic lab VLAN under change control replays noisy unfiltered data rather than modeled precursor behaviors, hurting repeatability and risking sensitive data exposure without proving detection of known precursors. Automating replay of modeled precursor behaviors inside an isolated civic lab VLAN under ticketing control tracks work as tickets rather than governing it with change control approval, risk communication, and municipal oversight.

Exam caveat: lab VLANs must truly isolate from production parks networks; mis-routed lab traffic can still touch live systems if segmentation is incomplete. Operational check: keep precursor detection drills separate from recovery workflow replay, verify lab runs use modeled precursors under change control, and compare detection outcomes after each parks detection or EDR update.