The correct answer is Control and process documentation.

This foundational component establishes the baseline of what must be protected and how it should be protected. It defines responsibilities, control objectives, acceptable behavior, logging requirements, and metrics that tell you what to monitor and why. Monitoring activities and technologies follow from the documented controls so they align with risk priorities and operational procedures.

Vulnerability scanning is an important technical activity but it is not the starting point. Scanning finds technical weaknesses, but it requires an inventory of assets and an understanding of which vulnerabilities map to documented controls and risks.

Security operations center describes an organizational function and not the documentation that must exist first. A SOC depends on policies and process definitions to set priorities, escalation paths, and responsibilities for handling alerts.

Security information and event management is a toolset for aggregating and analyzing logs. It is highly useful for monitoring but it must be configured based on documented controls and logging requirements so it monitors the right events and produces actionable alerts.

Full AWS Practitioner Certification Question