A transit-authority SOC chart shows L1 queue work, L2 deep-dive investigation, L3 hunt and IR surge, plus a separate engineer pod and a CISO-aligned architect. What organization does that chart describe?
Select an answer to reveal the explanation.
Short Explanation
Picture a firehouse: some crews take the first call, some run the complex scene, and a separate shop maintains the trucks while leadership plans stations. L1 through L3 are Analyst depth, not Splunk server names. Engineering and architecture sit beside that ladder, not on it.
Full Explanation
A typical SOC organizes Analyst work by investigation depth (queue, deep-dive, hunt or incident surge) and supports it with separate engineering and architecture functions. L1/L2/L3 are people and process tiers, not indexer or search-head labels. SOAR promotion and CIM acceleration are platform mechanics, not the org chart the blueprint asks candidates to recognize.