A transit-authority SOC chart shows L1 queue work, L2 deep-dive investigation, L3 hunt and IR surge, plus a separate engineer pod and a CISO-aligned architect. What organization does that chart describe?
Select an answer to reveal the explanation.
Short Explanation
Picture a firehouse: some crews take the first call, some run the complex scene, and a separate shop maintains the trucks while leadership plans stations. L1 through L3 are Analyst depth, not Splunk server names. Engineering and architecture sit beside that ladder, not on it.
Full Explanation
A transit-authority chart that shows L1 queue work, L2 deep-dive investigation, L3 hunt and IR surge, plus a separate engineer pod and a CISO-aligned architect, describes a typical SOC. Analyst work is tiered by investigation depth, and Engineer and Architect functions sit beside that ladder as distinct support and design roles. Civic SOCs use the same pattern so public-safety monitoring scales without forcing every defender to also own content and program design.
Calling the chart an Enterprise Security indexer cluster with search heads labeled L1–L3 fails by concept: L tiers name people and process depth, not Splunk infrastructure roles. Calling it a SOAR playbook promotion path fails by concept: draft-to-production automation lifecycle is a platform mechanic, not an org chart of Analysts, Engineers, and Architects. Calling it a CIM acceleration schedule fails by concept: data-model acceleration is indexing/search performance work, not staffing structure.
Exam caveat: Blueprint org questions test whether you recognize Analyst depth tiers versus Engineering and Architecture as separate functions—do not map human tiers onto indexer or search-head labels.
Operational check: When reviewing a municipal SOC org chart, label each box as Analyst depth, content engineering, or program architecture, and confirm that L1–L3 language never appears as Splunk server names in runbooks.