A county wants one workflow template that works for both malware and account-takeover tickets with branch-specific actions. What design goal is that?

Designing a reusable IR workflow pattern that covers multiple civic incident types with typed branches gives a county one teachable chassis for malware, account-takeover, and similar tickets while still allowing branch-specific actions. Shared intake, enrichment, and escalation stages remain common; typed branches select containment and notification steps appropriate to the alert class. That structure improves training consistency, reduces process invention under pressure, and lets automation authors maintain one template with typed branches instead of a fixed IR workflow pattern that forces multiple civic incident types through common linear steps without branch-specific containment.

Designing a fixed IR workflow pattern that forces multiple civic incident types through common linear steps fails because forcing every type through identical linear steps cannot execute the branch-specific containment and notification actions the workflow template must drive for malware versus account-takeover. Designing a reusable IR workflow pattern that isolates multiple civic incident types in separate cloned copies fails because isolating each type in its own clone abandons the one-template goal and does not provide shared intake with branch-specific containment and investigation actions that malware versus account-takeover tickets each require. Designing a reusable IR workflow pattern that routes multiple civic incident types with manual ad-hoc decisions fails because relying on manual ad-hoc decisions leaves branch selection to invention under pressure and cannot drive the consistent branch-specific containment and notification steps the workflow template must execute during the incident.

Exam caveat: Look for reusable IR patterns with typed branches when the stem asks for one template spanning multiple civic incident types. Do not confuse shared structure with a fixed IR workflow pattern that forces through common linear steps, and do not treat a reusable IR workflow pattern with manual ad-hoc decisions as flexibility when the exam is testing operational consistency.

Operational check for county IR: implement one workflow template with explicit branch discriminators for malware versus account takeover, dry-run both branches in a non-production ticketing sandbox, confirm branch-specific actions fire only on the matching type, and measure whether onboarding time for new analysts drops when they learn one chassis instead of relying on manual ad-hoc decisions that force analysts to invent steps under pressure.