Public-works leadership calls MFA a framework and MITRE ATT&CK a control. How should the analyst correct that mix-up and place Splunk?
Select an answer to reveal the explanation.
Short Explanation
A framework is the map; a control is a lock on a door. ATT&CK, NIST CSF, and CIS are maps, while MFA, logging, and segmentation are locks. Splunk reads those lock logs so the SOC can prove and hunt — it does not become the map or the lock.
Full Explanation
Public-works leadership that calls MFA a framework and MITRE ATT&CK a control has the categories reversed. ATT&CK, NIST CSF, and CIS are frameworks; MFA, logging, and segmentation are controls; Splunk is the evidence and analytics layer that helps the city prove and hunt against those controls. Civic briefings stay coherent when maps (frameworks), locks (controls), and cameras (SIEM analytics) are not conflated.
Calling MFA a framework and ATT&CK a firewall rule while saying Splunk replaces both fails by concept: MFA is a control, ATT&CK is a framework, and Splunk does not replace either category. Claiming frameworks and controls are the same word and Splunk is the control fails by concept: the terms are not synonyms and Splunk is not itself the control. Claiming Splunk is the framework and MFA is the CIM Authentication data model fails by concept: Splunk is a platform, MFA is a control, and CIM is a schema.
Exam caveat: Framework ≠ control ≠ SIEM platform—map each stem noun to the correct category before answering.
Operational check: In public-works security orientation slides, label ATT&CK/NIST/CIS as frameworks, list MFA/logging/segmentation as controls, and show ES as the place those control signals are monitored and evidenced.