Asset and Identity marks the elections voter-file server as high priority and a lab PC as low. How should Risk-Based Alerting treat those assets?
Select an answer to reveal the explanation.
Short Explanation
A voter-file server is the vault; a lab PC is the spare folding chair. Enterprise Security already stamped that priority in Asset and Identity, so Risk-Based Alerting should lean harder on the vault. Equal weights or ignoring A&I throw away the civic criticality the lookup just gave you.
Full Explanation
When Asset and Identity marks the elections voter-file server as high priority and a lab PC as low, Risk-Based Alerting should weight the voter-file server higher than the lab PC when scoring risk. Enterprise Security already stamped civic criticality into A&I; RBA is supposed to consume that priority so vaults score harder than spare folding chairs. Equal weights throw away the elections-sensitive context the lookup just provided for county defenders.
Giving the lab PC the same risk weight so every endpoint scores equally fails by concept: equal weights defeat asset priority and bury voter-file signal in noise. Ignoring Asset and Identity priority and scoring only by raw event count fails by concept: raw count without criticality mis-ranks civic impact. Disabling risk scoring on elections assets so those notables stay quiet fails by concept: high-priority elections assets need more attention, not less silence.
Exam caveat: RBA should honor Asset and Identity priority—higher civic criticality means higher risk weight on the exam and in production.
Operational check: Verify voter-file hosts carry high priority in A&I lookups, confirm risk notables for those hosts accumulate weight faster than lab endpoints, and tune thresholds only after validating priority fields are populating correctly.