A night-shift analyst sees a 911 CAD notable and immediately pulls the CAD network interface to contain it, skipping analysis. What is wrong with that sequence?
Select an answer to reveal the explanation.
Short Explanation
911 CAD is the city's heartbeat, not a lab PC you unplug for sport. Identify, scope, then analyze—then remediate. Skipping straight to pulling the NIC is out-of-order stages and a self-inflicted outage.
Full Explanation
Splunk's five investigation stages stay in order even on high-availability civic systems: identify, investigate/scope, analyze, remediate, then recover. Seeing a 911 CAD notable and immediately pulling the CAD network interface skips analyze (and proper scope) and risks public-safety availability before evidence confirms what to contain. Claiming pulling a NIC is always required as Splunk's first investigation stage fails by concept because stage one is identify, not containment. Saying CAD systems are out of scope for Enterprise Security notables fails by concept because civic public-safety hosts are in-scope for monitoring and investigation; availability concerns change how you remediate, not whether stages apply. Declaring analysis optional on public-safety hosts because MTTR must be zero fails by concept because rushing remediation without analysis can cause worse outages than the threat. Exam caveat: SPLK-5001 does not exempt 911 CAD from the five-stage order; criticality raises the bar for careful analyze-then-remediate, not for unplugging first. Operational check: for a CAD notable, complete identify/scope/analyze with clear evidence notes, use approved change control for any network isolation, and prefer targeted containment over yanking the production NIC without analysis.