What is a SOC, and how does it relate to security operations in enterprise architecture?

• A. A Security Operations Center monitors, detects, and responds to security events; integrates with monitoring, logging, and incident response processes across the architecture.
• B. A SOC is a string of security policies; does not monitor events.
• C. A SOC is a hardware firewall appliance.
• D. A SOC is a financial control office.

Answer: (B)

A Security Operations Center is a centralized function that continuously monitors, detects, and responds to security events, coordinating with monitoring, logging, and incident response processes across the enterprise architecture. It provides the focused people, processes, and technologies—often including SIEM, EDR, and threat intelligence—that give real-time visibility, standardized runbooks, and coordinated containment and recovery actions. In enterprise architecture, the SOC sits at the operations and security management layer, linking governance with technical controls and ensuring that security events are managed consistently across networks, endpoints, applications, and cloud environments. The idea that a SOC is just a string of security policies is incorrect because policies alone don’t observe or react to events; a SOC is about active monitoring and rapid response. Similarly, a SOC is not a hardware firewall appliance, nor a financial control office.