Which activity most clearly belongs to a Security Operations Center (SOC) rather than being the primary responsibility of a Computer Security Incident Response Team (CSIRT)?

### Why this is right A Security Operations Center (SOC) continuously monitors systems, analyzes alerts, and decides which activity needs escalation. A Computer Security Incident Response Team (CSIRT) takes a leading role when a significant incident requires coordinated handling. ### The concept The SOC is oriented toward ongoing observation and early detection. It filters false positives, prioritizes alerts, and provides technical findings. The CSIRT organizes response to a confirmed incident, including containment, eradication, forensics, recovery, communication, and lessons learned. These are functional distinctions, not an absolute rule that the teams never share work. ### The other options - **B. Coordinating post-incident legal reporting**: This is more closely associated with CSIRT coordination and legal or compliance stakeholders. - **C. Leading eradication of a confirmed breach**: Eradication is a core incident-handling responsibility. - **D. Managing the full recovery of affected services**: Recovery is part of coordinated incident response, though technical teams may perform the work. ### Terms - **SOC**: Security Operations Center, a monitoring and detection function. - **CSIRT**: Computer Security Incident Response Team, a team that coordinates incident handling. - **Alert triage**: Assessing alerts to decide their urgency and next action. ### Remember The SOC commonly spots and escalates; the CSIRT coordinates the response to a confirmed incident.