A parks department refuses to automate any action that can brick seasonal point-of-sale terminals. What selection filter is that?

A parks department that refuses to automate any action that can brick seasonal point-of-sale terminals is applying risk filters that exclude automation candidates capable of destroying revenue-critical endpoints. Seasonal POS gear is often unique, poorly imaged, and staffed by temporary workers; a bad reimage, firmware push, or mass reboot playbook can wipe a weekend's concessions revenue. Risk filters encode "do not automate" classes alongside "automate first" classes so defensive automation does not outrun operational reality in parks IT.

Why the other options fail by concept: Applying risk filters that exclude automation candidates with unverified alerts for seasonal POS terminals filters on alert verification, not brick capability; a verified alert can still trigger a playbook that bricks a revenue-critical terminal. Applying risk filters that exclude automation candidates with minimal time savings on seasonal POS terminals optimizes for efficiency, not safety, and can still select high-saving playbooks that brick POS terminals. Applying risk filters that exclude automation candidates missing off-peak windows for seasonal POS terminals filters on timing availability, not brick capability, so an action with an off-peak window can still brick a POS terminal.

Exam caveat: Excluding brick-capable actions from automation does not mean POS is unmonitored—detection and manual runbooks still apply, with change windows for invasive fixes. Operational check: list parks automation candidates, mark any that can reimage, flash, or mass-reboot POS as blocked, require dual control for those manual procedures, and verify SOAR allowlists omit those actions.