An emergency-management fusion center enriches security alerts with weather and event context during disasters. What enrichment approach is that?
Select an answer to reveal the explanation.
Short Explanation
During a hurricane, context is half the alert—storm track and shelter surge matter. Glue weather and event data onto the ticket. You'll nail it by calling it domain-specific, since weather and events aren't geolocation, asset, or threat-feed signals.
Full Explanation
An emergency-management fusion center that enriches security alerts with weather and event context during disasters is using domain-specific enrichment. In civic disaster operations, storm track, shelter openings, and planned public events change how analysts prioritize outages, phishing spikes, and OT-adjacent IT alerts. Attaching that non-CVE context to security tickets aligns cyber triage with the fusion center's real decision environment instead of treating every alert as an isolated vulnerability finding.
Why the other options fail by concept: Geolocation enrichment that adds weather and event context to alerts during disasters mislabels the work, because geolocation enrichment adds IP-to-location, coordinates, and jurisdiction for scoping, not civic storm-track and public-event conditions, so calling weather/event context geolocation confuses location tagging with domain-specific enrichment. Asset-context enrichment that adds weather and event context to alerts during disasters mislabels the work, because asset-context enrichment adds ownership, criticality, and system details for prioritization, not the external storm and public-event conditions that emergency managers need to interpret security alerts. Threat-feed enrichment that adds weather and event context to alerts during disasters mislabels the work, because threat-feed enrichment adds indicator reputation and actor TTP context from external feeds for triage, not the situational weather and event context required for disaster response.
Exam caveat: Weather and event enrichment informs priority and narrative; it does not replace technical indicator validation or authorize skipping containment when a true compromise is confirmed. Operational check: during a disaster drill, confirm security alerts receive weather/event fields in the fusion ticket, and verify analysts can filter or rank by storm phase without losing the underlying technical enrichment.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.