Write an evidence-based operational update

Case	First confirmed activity	Detection	Effective containment
EL-1	09:00	09:10	09:30
EL-2	10:00	10:20	10:50
EL-3	11:00	11:30	12:10

Case

First confirmed activity

Detection

Effective containment

EL-1

09:00

09:10

09:30

EL-2

10:00

10:20

10:50

EL-3

11:00

11:30

12:10

Confirmed: unauthorized access to 60 restricted records. Unknown: whether the records were copied outside the environment; relevant egress telemetry is missing. Remediation inhibitor: vendor-certified patch unavailable until October 12; interim restriction verified. Update deadline: 16:00 UTC; the next update must name an owner, outstanding evidence, and next checkpoint.

single choice

Under the supplied definitions, what are mean detection and containment times?

2 pts

30 minutes to detect; 20 minutes from detection to containment 60 minutes to detect; 90 minutes from detection to containment 20 minutes to detect; 30 minutes from detection to containment 20 minutes to detect; 50 minutes from detection to containment

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

single choice

What is the on-time verified remediation rate for the due cohort?

2 pts

90%, counting late verified treatments as on time About 88%, leaving the three late findings out of the denominator 75%, retaining all 20 due findings in the denominator About 83%, excluding the two open findings

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

single choice

Which executive update is supported by the evidence?

2 pts

Declare no data exposure because no egress log exists State that 60 records were exfiltrated and that customer notification has begun Hold the update until the egress question is resolved so the message is complete Confirm unauthorized access, disclose the egress visibility gap, name investigation ownership, and give the next update time

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

single choice

Which remediation handoff best explains the still-open vendor-dependent item?

2 pts

Close it permanently because the vendor has promised a patch Record the item as overdue against the SLA and escalate it to the engineering manager Replace all context with the scanner's numeric severity Document the vendor patch date, verified interim restriction, residual risk owner, and retest plan

Need a hint?

Restate the exact outcome or failure the prompt asks about before comparing choices.

Show another hint

Eliminate choices that solve a nearby problem, change more than requested, or do not fit the evidence.

Original practice · Review pending

Inspect the evidence

Incident cohort in UTC

Reporting constraints

Complete the response

Under the supplied definitions, what are mean detection and containment times?

What is the on-time verified remediation rate for the due cohort?

Which executive update is supported by the evidence?

Which remediation handoff best explains the still-open vendor-dependent item?

Review your result

Attempt history

Question or answer look wrong?