A school district encodes error handling when the sandbox API is down mid-playbook. What resilience practice is that?

A school district that encodes error handling when the sandbox API is down mid-playbook is designing resilient SOAR behavior for civic tool outages. External sandboxes, intel APIs, and identity connectors fail; handling SIEM forwarding errors, handling ticketing sync delays, or revalidating deployment credentials mid-run do not handle a sandbox outage mid-run and leave the playbook stuck when the sandbox goes dark. Explicit timeouts, retries with backoff, fallback enrichments, and escalate-to-human paths keep student and staff incident handling moving when a dependency naps during the school day.

Why the other options fail by concept: Handling SIEM forwarding errors mid-run builds resilience for a different downstream dependency, but it provides no timeout, fallback, or error path when the sandbox API itself is down mid-playbook. Handling ticketing sync delays mid-run keeps case creation moving when the ticketing system lags, but it assumes enrichment already succeeded and does nothing to keep the playbook moving during a sandbox API outage. Revalidating deployment credentials mid-run rechecks setup secrets during execution, not runtime resilience for an outage; it cannot recover a playbook when the sandbox API fails mid-execution.

Exam caveat: Resilience patterns must balance fail-open and fail-closed carefully—some safety systems should not fail open, but handling SIEM forwarding errors is resilience for downstream log delivery, not a runtime fail-open or fail-closed decision for the sandbox dependency error. Operational check: define timeout, retry, fallback, and escalation for each external call; simulate sandbox downtime in staging; and verify cases land with analysts through real-time error handling rather than relying on SIEM-error handling, ticketing-delay handling, or mid-run credential revalidation alone.