After a library ransomware scare, leadership asks who should write a new "suspicious SMB spike" correlation search and who should work the first notable it creates. How should those duties be split?
Select an answer to reveal the explanation.
Short Explanation
Writing the smoke detector and answering when it beeps are two jobs. Engineers author the correlation search; Analysts take the first notable it drops on Incident Review. Architects are not the night-shift queue, and app admin is not detection authorship.
Full Explanation
After a library ransomware scare, authorship of a new "suspicious SMB spike" correlation search belongs to the SOC Engineer, and working the first notable that search creates belongs to the SOC Analyst. Detection content creation and first-line consumption are deliberately split so municipal libraries can get durable detections without turning the night shift into unpaid content authors. That split keeps civic response fast while keeping content quality with the engineering role.
Having the Architect author the search while the Engineer works the first notable fails by concept: Architects set coverage strategy; they are not the primary authors of a single SMB search, and Engineers are not the primary queue consumers. Having the Analyst author during triage while the Architect works the notable fails by concept: triage time is for investigation, and Architects do not staff first-line notable handling as their core job. Claiming the ES administrator does both because they own the app fails by concept: app administration is not synonymous with detection authorship or Analyst queue work.
Exam caveat: Stem phrases that pair "who writes the search" with "who works the notable" almost always expect Engineer then Analyst.
Operational check: File an Engineer ticket to author and peer-review the SMB correlation search with ATT&CK annotation, enable it in a monitored window, and confirm the first notable lands on Incident Review for Analyst disposition—not for content redesign mid-triage.