FortiGuard SOC-as-a-Service provides managed security monitoring, threat investigation, alert triage, and incident-response assistance for organizations that require dedicated security operations capabilities.
Option B is correct because SOCaaS provides continuous monitoring of security telemetry forwarded from protected FortiSASE and FortiGate environments. Fortinet ' s managed security specialists investigate suspicious activity, correlate events, and escalate validated incidents. This capability provides ongoing visibility into security threats affecting connected users and protected endpoints, within the scope of integrated telemetry sources.
Option D is correct because SOCaaS centralizes security event analysis and incident visibility. Logs and alerts collected from different enforcement points can be correlated to support investigations and coordinated remediation, reducing the operational fragmentation associated with independent monitoring systems.
Option A is incorrect because bandwidth analytics primarily belongs to network monitoring, traffic analytics, and digital experience monitoring rather than the core SOCaaS security-operations function.
Option C is incorrect because SOCaaS does not replace endpoint protection. FortiClient, endpoint detection and response, and other security controls continue to provide essential prevention and endpoint telemetry.
The Study Guide describes SOCaaS as a 24/7 managed service incorporating FortiGuard intelligence, expert investigation, and security orchestration capabilities.
[References: FortiSASE 25 Enterprise Administrator Study Guide, pages 125–126, SOCaaS and SOCaaS Workflow; FortiSASE 26.1 Administration Guide — Forwarding Logs to SOCaaS., ==========, ]
