ITPEC FE Subject A April 2024 Question 32
Which of the following is an appropriate term for an organized and highly skilled team whose mission is to continuously monitor and improve an organization’s security posture while preventing, detecting, analyzing, and responding to cybersecurity incidents, utilizing both technology and well-defined processes and procedures?
Explanation
Security Operations Center (SOC) — the dedicated team that monitors security around the clock and detects, analyzes and responds to incidents.
A SOC combines people, processes and technology (log collection, SIEM, intrusion detection) to watch an organization's systems continuously, spot attacks, analyze alerts and start the response, while feeding what it learns back into improving the security posture. The question's description, an organized team that monitors, prevents, detects, analyzes and responds using technology and defined procedures, is the definition of a SOC.
Answer (d)
Why not others:
- •(a) Cybersecurity — the discipline of protecting systems and data as a whole, not a team or organization
- •(b) Incident Management Center (IMC) — not an established name for such a team; the team that handles security incidents is usually called a CSIRT
- •(c) Network Operations Center (NOC) — monitors the network's availability and performance, not security threats
Key rule: SOC watches for and triages attacks continuously; CSIRT leads the response once an incident is declared; NOC keeps the network running.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.