The mayor's office wants a three-year plan for how the municipal SOC will cover MITRE ATT&CK, which data sources to buy, and how Enterprise Security plus SOAR will mature. Which role owns that plan?
Select an answer to reveal the explanation.
Short Explanation
A three-year ATT&CK-and-buy-data plan is city planning, not tonight's ticket. Architects draw the map for coverage, sources, and how ES plus SOAR should grow. Analysts work the queue; engineers implement content on that map.
Full Explanation
When the mayor's office wants a three-year plan for municipal SOC ATT&CK coverage, which data sources to acquire, and how Enterprise Security plus SOAR will mature, the owner is the SOC Architect. That deliverable is program design: coverage strategy, telemetry investment, and platform maturity across fiscal years—not tonight's ticket and not a single correlation search. Civic leadership briefings need that architectural ownership so budget and procurement align to a coherent defense roadmap.
Assigning the night-shift Analyst fails by concept: seeing ATT&CK annotations on notables during triage does not make the Analyst author of multi-year coverage strategy. Assigning the Detection Engineer fails by concept: writing or buying one data source and implementing content is execution against a roadmap, not owning the three-year buy-and-cover plan itself. Treating the incident commander as owner fails by concept: even a major investigation remains an operational case, not platform-maturity architecture.
Exam caveat: Architect questions emphasize strategy, coverage heatmaps, and maturity; Engineer questions emphasize implementation; Analyst questions emphasize shift work—match the time horizon in the stem.
Operational check: Publish an Architect-owned roadmap that lists ATT&CK coverage gaps, prioritized sourcetypes, ES/SOAR maturity milestones, and hand those milestones to Engineers as implementation epics while Analysts continue working the live queue.