A transit SOC caches threat-intel lookups so enrichment stays within API rate limits during major events. What enrichment design is that?

A transit SOC that caches threat-intel lookups so enrichment stays within API rate limits during major events is using rate-aware enrichment automation. Parade weekends, race days, and transit surges multiply alerts; queue-based enrichment automation that caches threat-intel lookups during deferred analyst review withholds cached context until deferred analyst review instead of applying it automatically to stay within limits during the surge. Caching recent answers for repeated indicators keeps civic enrichment available under load while respecting vendor quotas.

Why the other options fail by concept: Queue-based enrichment automation that caches threat-intel lookups during deferred analyst review ties reuse of cached lookups to deferred analyst review instead of rate-aware automation during civic surge periods, so enrichment is not available within API limits when surge volume hits. Playbook-driven enrichment automation that caches threat-intel lookups during incident playbook reuse limits caching to incident playbook reuse instead of rate-aware caching during civic surge periods, so it does not keep enrichment within API rate limits during major events. Indicator-based enrichment automation that caches threat-intel lookups during past score retention focuses on retaining past scores rather than rate-aware reuse during civic surge periods to reduce outbound lookups under quota.

Exam caveat: Caches must honor intel TTL and invalidate on higher-confidence updates; stale cache entries can understate a newly weaponized indicator during a long event. Operational check: load-test enrichment with repeated indicators at parade-weekend volume, confirm cache hit rates keep outbound API calls under quota, and verify TTL refresh still pulls fresh intel for aging cache keys.