For real-time tracking of pen-test cases and clear differentiation from other incidents, which practice should you implement?

• A. Implement case tagging (e.g., PenTest) and use it for filtering/monitoring.
• B. Create a dashboard connected to the data lake with pre-built templates based on pen test IP range.
• C. Custom SOAR playbook to summarize case metadata and email the CISO.
• D. Custom alert rule to high-severity for pen test IPs.

Answer: (A)

Tagging cases with a PenTest label creates a lightweight, consistent metadata layer that you can rely on across your monitoring, alerting, and ticketing tools. When every pentest event carries that tag, dashboards and filters can show the active pentest workload in real time, separate from other incidents, and analysts can quickly drill into those items without wading through unrelated alerts. This approach scales with multiple tests, teams, and tools because the tag travels with the case through triage, investigation, and resolution, enabling automated routing, focused metrics, and clear reporting to stakeholders. Other options address parts of the problem—like dashboards tied to a fixed IP range, or notifying leadership via a specific playbook, or raising high-severity alerts for pentest IPs—but they don’t provide the persistent, cross-tool differentiation and real-time visibility that tagging enables. Tagging is the practical foundation for accurate, real-time tracking and clean separation of pen-test activity from other incidents.