The main purpose of the SOC is:

Question

Options

• AAn organization which provides Tier 1 support for technology issues and provides escalation
• BA distributed organization which provides intelligence to governments and private sectors on
• CThe coordination of personnel, processes and technology to identify information security events
• DA device which consolidates event logs and provides real-time analysis of security alerts

• A
  4% (1)
• B
  4% (1)
• C
  85% (23)
• D
  7% (2)

Explanation

SOC stands for Security Operations Center, a centralized unit that brings together people, processes, and technology to continuously monitor, detect, and respond to information security events - making C the correct definition.

Why the distractors fail:

• A describes a help desk or IT support tier model, not a security-focused operations center
• B partially hints at threat intelligence functions but mischaracterizes the SOC as a distributed intel-sharing body (that's more like an ISAC - Information Sharing and Analysis Center)
• D describes a SIEM (Security Information and Event Management) tool, not the SOC organizational concept itself - a SIEM is a technology used by a SOC, not the SOC itself

Memory tip: Think of SOC as the "security nerve center" - it's always about the triad of People + Process + Technology working together. Whenever an answer choice describes a single device or a narrow function (help desk, intel sharing), eliminate it. The SOC answer will always be the one that spans the whole security monitoring mission.

No community discussion yet for this question.