Palo Alto Networks Certified Cybersecurity Entry-level Technician (PCCET)Security OperationsMedium
A global financial institution operates multiple Security Operations Centers (SOCs) across different continents to provide 24/7 coverage and comply with regional data residency regulations. Each regional SOC independently handles local incidents but shares threat intelligence and maintains a global incident response plan. What type of SOC model does this describe?
- ADistributed SOC
- BVirtual SOC
- COutsourced SOC
- DCentralized SOC
Show answer & explanationAnswer & explanation
Correct answer: A. Distributed SOC
A distributed SOC model involves multiple, geographically dispersed SOCs that operate somewhat independently but collaborate and share information, which aligns with the scenario of regional SOCs handling local incidents while sharing intelligence globally.
Why the other options are wrong
- B. A virtual SOC is a conceptual model where functions are performed by individuals or teams without a dedicated physical space.
- C. An outsourced SOC means the security operations are handled by a third-party vendor.
- D. A centralized SOC has a single, main location for all security operations.
Distributed SOC Model
A Security Operations Center model where multiple, geographically dispersed SOCs operate, often with regional responsibilities, but collaborate and share information globally.
- Provides 24/7 coverage across time zones.
- Supports regional compliance and data residency.
- Requires strong communication and coordination mechanisms.
Memory trick: Central, Out, Distributed, Virtual – where's your team?