Which Adaptive Response usage is appropriate for the city SOC?
Select an answer to reveal the explanation.
Short Explanation
Auto-containment is a fire-suppression system, not a smoke detector on every burnt piece of toast. A confident C2 hit on a kiosk can trip that system. A noisy failed logon on the mayor should not lock the office.
Full Explanation
Adaptive Response containment is appropriate when confidence is high and blast radius is well scoped—for example, auto-running a containment Adaptive Response on a high-confidence true-positive C2 match for a disposable library kiosk—not when the signal is noisy failed logons against executive accounts. That usage keeps AR useful for civic defense without turning every weak notable into account destruction or mass isolation. Auto-disabling the mayor's account on every noisy failed-logon notable is disproportionate and can lock out critical civic leadership on routine noise. Auto-isolating every workstation whenever a notable status is New treats status as verdict and can strand staff across the city. Skipping Adaptive Response entirely because only SOAR developers may act misstates analyst scope: analysts are expected to use AR appropriately, including enrichment and carefully scoped containment. Exam caveat: match AR impact to confidence and asset criticality—library kiosk C2 containment can be automatic; executive disable and blanket isolation on New status cannot. Operational check: for a verified C2 true positive on a library kiosk, confirm AR containment is enabled and scoped to that host class; for failed-logon notables on executives, use enrichment or notify-and-approve paths and verify no auto-disable is attached.