A SOC wants new phishing inboxes quarantined automatically instead of waiting for an analyst to click. Which automation use case best describes this change?
Show the answer and why
Answer: A. Enabling or disabling services and access.
Quarantining a mailbox cuts off access as the containment action, and doing it from a detection rule is the enabling or disabling services and access use case. You gain reaction time because no human is in the loop.
Scored the same way in practice: the explanation is always visible after you answer.