問題文
An engineer is deciding how much of a phishing response procedure to automate. The procedure gathers headers and reputation data, judges whether the message is malicious, and then removes it from every recipient's mailbox. Which split is appropriate for a first implementation?
選択肢
- Automate all three stages at once, because an implementation that stops for human input does not reduce the mean time to respond and therefore cannot be justified against the engineering effort it costs.
- Automate the gathering, present the gathered evidence to the analyst for the judgment, and put the removal behind an explicit approval so a wrong judgment does not delete legitimate mail at scale, because a bulk removal is hard to reverse.
- Automate nothing until the procedure has been stable for a quarter, because automating a procedure that still changes creates more maintenance work than it saves over a quarter.
- Automate only the removal, because it is the most repetitive step, and leave the gathering and the judgment to the analyst who has the context to do both quickly within the same session.