Which function is not typically a SOC function?

Which function is not typically a SOC function?

• A. Threat intel ingestion and alert triage.
• B. Incident response coordination.
• C. Public safety coordination during a cyber-physical incident.
• D. Post-incident reviews.

Answer: (C)

The main idea here is understanding what a SOC normally handles in security operations. A SOC focuses on monitoring for security events, analyzing alerts, and directing the right response. Ingestion of threat intelligence and triage of alerts are core activities because they turn raw data into prioritized incidents the team can act on. Incident response coordination is central because the SOC or an incident response team keeps the response organized, communicates status, and works to contain, eradicate, and recover from threats. Post-incident reviews are also part of the SOC lifecycle, providing lessons learned to strengthen defenses for the future. Public safety coordination during a cyber-physical incident isn’t typically handled by the SOC. That kind of work involves external authorities, emergency responders, and physical safety considerations, often managed by crisis management, an incident command structure, or OT/ICS teams that handle risk to people and infrastructure. The SOC may provide information and support, but the primary responsibility for coordinating with public safety lies outside the SOC’s normal duties.

The main idea here is understanding what a SOC normally handles in security operations. A SOC focuses on monitoring for security events, analyzing alerts, and directing the right response. Ingestion of threat intelligence and triage of alerts are core activities because they turn raw data into prioritized incidents the team can act on. Incident response coordination is central because the SOC or an incident response team keeps the response organized, communicates status, and works to contain, eradicate, and recover from threats. Post-incident reviews are also part of the SOC lifecycle, providing lessons learned to strengthen defenses for the future.

Public safety coordination during a cyber-physical incident isn’t typically handled by the SOC. That kind of work involves external authorities, emergency responders, and physical safety considerations, often managed by crisis management, an incident command structure, or OT/ICS teams that handle risk to people and infrastructure. The SOC may provide information and support, but the primary responsibility for coordinating with public safety lies outside the SOC’s normal duties.