After identifying a notable on a county permitting host, the analyst's next move is to reimage every PC in the department. Which Splunk investigation stage should come next instead?
Select an answer to reveal the explanation.
Short Explanation
Identifying the alarm is not the same as knowing which rooms are smoky. Next up is investigate and scope: which hosts, which users, which hours. Reimaging the whole permitting floor is a later decision, and it is a terrible first guess.
Full Explanation
After identify, Splunk's second investigation stage is investigate and scope: bound which hosts, users, and time window are involved before containment theater. On a county permitting host notable, that means pivoting with CIM and Asset and Identity to list related systems and identities rather than reimaging an entire department. Recovering the permitting database from last month's tape and then scoping later fails by concept because recover is stage five and restoring service before scoping can erase or obscure evidence and skip analysis. Skipping scoping to write the after-action report while the notable is still New fails by concept because documentation of lessons belongs after remediate and recover, not in place of scoping. Closing the notable as Resolved because a reimage is already planned fails by concept because workflow closure is not a substitute for investigative method and does not prove scope was understood. Exam caveat: SPLK-5001 keeps identify → investigate/scope → analyze → remediate → recover in order; planned reimages do not skip scope. Operational check: from the permitting notable, list distinct hosts, users, and the earliest-to-latest contributing window before any department-wide reimage ticket is approved.