The correct answer is Threat detection emphasizes continuous monitoring to surface active or imminent attacks, whereas vulnerability management identifies, evaluates, and remediates security weaknesses. In AWS this typically maps to continuous detectors for active threats and scanning or assessment tools for vulnerabilities.

Threat detection focuses on continuous collection and analysis of telemetry so teams can surface suspicious activity quickly and respond. Services such as Amazon GuardDuty examine VPC flow logs, AWS CloudTrail, and DNS logs to detect indicators of compromise and generate alerts for investigation.

Vulnerability management is a proactive lifecycle that inventories assets, scans for software and configuration flaws, prioritizes findings by risk, and tracks remediation or patching. Tools like Amazon Inspector help discover and prioritize vulnerabilities so teams can fix or mitigate them before they are exploited.

Both threat detection and vulnerability management are only about satisfying compliance audits is incorrect because these disciplines primarily exist to reduce risk and to detect and remediate security issues, and they only secondarily support compliance.

Threat detection is about finding potential configuration weaknesses, while vulnerability management continuously watches for malicious activity is incorrect because this statement inverts the responsibilities. Monitoring for active or imminent attacks belongs to threat detection and identifying weaknesses belongs to vulnerability management.

Threat detection primarily covers encryption and IAM controls, while vulnerability management focuses on incident response and service recovery is incorrect because encryption and IAM are preventive controls that span many security areas and incident response and recovery are broader operational functions, and those distinctions do not define the two disciplines.

Full AWS Practitioner Certification Question