A single licensing-counter kiosk at the city's DMV-style office is compromised and phones home. Days later, dozens of similar kiosks report to the same controller. How should the analyst label the one host versus the coordinated collection?

A single licensing-counter kiosk at the city's DMV-style office is compromised and phones home; days later, dozens of similar kiosks report to the same controller. Correct labeling is that the one kiosk is a bot and the fleet reporting to one controller is a botnet. Civic framing matters because public-facing municipal kiosks are shared endpoints; analysts must scope response to one host versus the whole collection when coordinating takedown and Enterprise Security notables.

Saying the one kiosk is a botnet and the fleet is a single bot fails by concept: it inverts the definitions—botnet is the coordinated collection, bot is the individual compromised host. Calling the one kiosk command-and-control and the fleet zero trust fails by concept: C2 is the channel or controller infrastructure, not the victim kiosk, and zero trust is an access-verification model, not an infected fleet. Labeling the kiosk an APT and the fleet social engineering fails by concept: APT names adversary class and persistence, and social engineering names human manipulation—neither is the bot-versus-botnet distinction.

Exam caveat: SPLK-5001 terminology questions expect bot = one directed host and botnet = coordinated collection under one controller—do not swap those labels or rename the victim as C2.

Operational check: Pivot from the first kiosk beacon to shared controller indicators, enumerate peer kiosks calling the same C2, scope containment to the fleet, and word notables and threat intel so one host and the licensing-kiosk botnet stay clearly separated.