A clerk mailbox may have sent a large archive off-network, and the wastewater plant reported a PLC setpoint change in the same hour. Which source is useful for the data-leaving question and should not be first for the PLC change?
Select an answer to reveal the explanation.
Short Explanation
DLP is the loading-dock camera: it is great when something is leaving the building in a mail truck, and a lousy first camera for a pump-station setpoint. Match the sensor to the question. The historian and CAD radio will not tell you about the archive.
Full Explanation
A clerk mailbox possibly sending a large archive off-network is an email-exfiltration question; a wastewater PLC setpoint change in the same hour is an OT process-change question. Outbound mail DLP alerts are useful for the data-leaving question and should not be first for the PLC change. Right source for the right question—shared clock time does not merge telemetry planes in a civic SOC.
Using the industrial historian as the primary source for both the mailbox archive and the PLC write fails for the mailbox side; historians do not prove email exfiltration. Using the public-library Wi-Fi controller as first source for both fails by relevance to neither mailbox DLP nor PLC setpoints. Using 911 CAD radio-console syslog as primary mailbox-exfil evidence fails by system role—CAD radio logs are not mail DLP and do not inventory outbound archives.
Exam caveat: concurrent civic incidents still need per-question sources; DLP for mail exfil, historian plus jump-host and OT firewall for PLC writes.
Operational check: pull mail DLP and gateway logs for the clerk archive; separately pull historian setpoint audits, jump-host authentication, and industrial firewall for the PLC change; avoid cross-wiring the two investigations in one undirected search.