What is the purpose of a Security Operations Center (SOC) in integrated defense, and what are its three core functions?

• A. SOC monitors, detects, and responds to security events; core functions: continuous monitoring, incident management, threat hunting and forensics.
• B. SOC analyzes compliance reports; core functions: policy drafting, training, archiving.
• C. SOC monitors only for physical security.
• D. SOC replaces all other security tools.

Answer: (A)

In integrated defense, a Security Operations Center serves as the centralized hub that provides real-time visibility and coordinates response to security events across digital and physical domains. Its purpose is to monitor, detect, analyze, and respond to threats so incidents are contained quickly and defenses are strengthened over time.

The three core functions are continuous monitoring, incident management, and threat hunting and forensics. Continuous monitoring means keeping a live watch over networks, endpoints, logs, and sensors to spot signs of trouble as they arise. Incident management covers the end-to-end handling of security events—from triage and containment to eradication, recovery, and post-incident review. Threat hunting and forensics involve proactively searching for hidden threats and diligently investigating artifacts and attacker techniques to understand how breaches occurred and to prevent recurrence.

This combination is what makes the SOC effective: it continuously watches for issues, responds decisively when something is detected, and actively investigates to uncover adversaries and strengthen defenses. The other statements miss essential aspects of the SOC’s role, such as ongoing monitoring and active investigation, or they imply functions like compliance reporting, limited physical security scope, or replacing all security tools, which don’t capture the operational purpose of the SOC in integrated defense.