A notable fires on the city's 911 CAD server. Why is automatic isolation Adaptive Response usually the wrong next step?
Select an answer to reveal the explanation.
Short Explanation
Auto-isolating 911 CAD is like padlocking the firehouse during a call. Notify a human and get approval on high-availability civic systems. Containment that takes dispatch offline fails the city even if it succeeds in ES.
Full Explanation
Automated containment Adaptive Response is usually the wrong next step when a notable fires on a high-availability civic system such as the city's 911 CAD server, because isolation or similar containment can take dispatch offline and harm public safety even if the notable is interesting. Prefer notify-and-approve or enrichment-first paths so a human confirms impact before any containment that could interrupt 911 operations. Claiming Adaptive Response cannot target Windows hosts is false and does not explain the policy choice. Claiming CAD servers are out of scope for Enterprise Security notables is false; CAD can and should generate notables, but response design must respect availability. Claiming isolation is only legal after a SOAR developer rewrites the playbook in Python confuses legal/approval judgment and availability risk with playbook authoring requirements. Exam caveat: match AR automation to asset criticality—disposable kiosks differ from 911 CAD; SPLK-5001 expects analysts to know when not to auto-contain. Operational check: for the 911 CAD notable, verify AR is limited to notification or enrichment, confirm no auto-isolate is attached to that detection, page the on-call approver, and document the approval path before any containment is considered.