Domain 4 · Objective reference 4B1 · Chapter 30 of 35
Use response tools with evidence limits
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A tool observation needs context and corroboration.
Explore the anchors
Collect relevant trustworthy observations.
Concept matching activity
Match this task or description to its concept:
Correlate evidence and identify uncertainty.
Choose a concept before checking the explanation.
Detection laboratory
Positive means the detector raised an alert. True/false compares that decision with known reality.
False negative — An attack exists. No alert was raised.
| Detector | Attack present | No attack |
|---|---|---|
| Alert | True positive | False positive |
| No alert | False negative | True negative |
Change the threshold
Eight fictional events have fixed known truth. An alert fires when the synthetic score is at least the threshold. The score is not a probability of attack.
TP 2 · FP 1 · FN 2 · TN 3. Precision 67%. Recall 50%.
Precision = TP ÷ (TP + FP). Recall = TP ÷ (TP + FN). Lower thresholds can increase detection and false alarms; this tiny dataset does not establish real-world performance.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Move from an event to a coordinated response
Management concept and decision mechanism
Response tools can collect and correlate events, analyze artifacts, manage cases and execute approved actions. Their value depends on visibility, time alignment, access, retention, integrity and trained operators. A tool can fail silently if a source is disconnected. AI-assisted summaries or prioritization need review of input quality, confidence and missed conditions. Do not treat tool output as independent proof of attribution or incident scope. Maintain approved access and evidence procedures, and ensure automation has bounded authority and an accountable exception route.
Move from an event to a coordinated response
An observed event or alert is an input to triage, not automatically a confirmed incident. Reports can come from staff, suppliers, monitoring, or service failures. Assess credibility, relevant assets, potential impact, and available evidence using defined criteria. Record suspected as well as confirmed facts and escalate promptly where the evidence or potential consequence warrants it.
Select investigative tools for the question being answered and the responder's authorization. Record collection time, source, handling, and integrity checks appropriate to the evidence. Preserve original records where required and control access. Specialist advice and the actual applicable requirements determine legally appropriate handling; a particular tool or hash alone is not a guarantee of admissibility.
Worked example
A central detector receives no event because a forwarding service failed; the team repairs telemetry delivery and performs an end-to-end retest.
Check your understanding
Why can adding another detection rule fail to fix a missing alert?
Show explanation
The source or transport may be absent, so the rule never receives the evidence it needs.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.