Which Adaptive Response usage is appropriate for the city SOC?
Select an answer to reveal the explanation.
Short Explanation
Auto-containment is a fire-suppression system, not a smoke detector on every burnt piece of toast. A confident C2 hit on a kiosk can trip that system. A noisy failed logon on the mayor should not lock the office.
Full Explanation
Adaptive Response containment is reserved for high-confidence, well-scoped true positives such as C2 on a disposable library kiosk. Noisy failed logons and New status alone are not enough to auto-disable executives or isolate every workstation. Analysts still use AR; they do not leave all action to SOAR developers.