The municipal SOC defines MTTR as starting at detection and ending when the threat is contained. A parks kiosk sat undetected for six days and was then isolated in 45 minutes. Which statement about MTTR is correct?
Select an answer to reveal the explanation.
Short Explanation
They spotted it and had the kiosk isolated in 45 minutes—that is MTTR under the city's definition. The six days of blindness is MTTD (and it inflates dwell). Do not mash those clocks into one number.
Full Explanation
When a civic SOC defines MTTR as starting after detection and ending when the threat is contained, the parks-kiosk MTTR is the forty-five-minute isolate window after notice. The six undetected days belong to MTTD and contribute heavily to dwell; they are not added into that post-detection MTTR figure under the city's definition. Including the six undetected days because dwell and MTTR are identical fails by concept because dwell spans unseen presence plus response, while this MTTR definition is explicitly post-detection only. Defining MTTR as only the time until the help desk first hears a clerk complaint fails by concept unless that complaint is how detection occurred; complaint time is not automatically MTTR. Starting MTTR at first adversary access before any detection fails by concept under this municipal definition—that start belongs to dwell and MTTD framing, not post-detection MTTR. Exam caveat: know the local definition; SPLK-5001-style questions often separate MTTD (blind period) from MTTR (response after notice) on civic assets. Operational check: document MTTR start equals detection and end equals isolate for the kiosk, report the six-day MTTD and dwell components separately, and keep those definitions consistent in SOC metrics reviews with leadership.