A city SOC designs a phishing SOAR playbook that detonates the URL, checks intel, notifies the user, and resets credentials if needed. What design practice is that?

A city SOC that designs a phishing SOAR playbook to detonate the URL, check intel, notify the user, and reset credentials if needed is structuring a multi-step playbook for a common municipal incident path. Explicit steps make enrichment, communication, and remediation observable, testable, and reviewable. Analysts and auditors can see which civic mailboxes were touched and why, instead of structuring a linear-execution SOAR playbook for a common municipal phishing incident path that runs as a fixed straight-line sequence without conditional logic for the if-needed credential reset and misses the branching the playbook requires. The pattern matches how real phishing response unfolds across email gateway, sandbox, intel, identity, and user notification systems.

Why the other options fail by concept: Structuring a linear-execution SOAR playbook for a common municipal phishing incident path is a fixed straight-line sequence without conditional branching, not a defined multi-step playbook with decision logic, so it fails to capture the detonate, intel check, user notification, and conditional reset sequence and complicates audit and tuning when the city must explain conditional actions on staff mailboxes. Structuring an intel-enrichment SOAR playbook for a common municipal phishing incident path covers only the intel-check enrichment task, not an orchestrated phishing response, so it fails to scale and produces inconsistent handling across shifts without the detonate, notify, and reset steps. Structuring a cross-agency SOAR playbook for a common municipal phishing incident path supports broader situational awareness but does not itself detonate the URL, notify the affected user, or reset credentials, so it cannot provide the evidence and awareness steps that prevent repeat clicks and incomplete containment for this incident.

Exam caveat: A well-structured playbook still needs thresholds and approval gates before high-impact resets on privileged municipal accounts. Operational check: encode the detonate → intel → notify → conditional reset path in SOAR, unit-test each step against fixtures, and require human approval before credential reset for high-risk city roles.