The correct option is Centralized log collection and analysis.

Centralized log collection and analysis aggregates logs and telemetry from servers, applications, network devices and security controls and it provides the visibility needed to detect patterns and correlate related events. It enables timeline reconstruction, alerting and automated detection using a SIEM or analytics tools and it preserves context for investigations. Ongoing information security monitoring depends on this centralized visibility to identify incidents in real time and to support effective response.

Ingesting threat intelligence feeds is useful for enriching alerts and for providing indicators of compromise, but feeds do not by themselves collect the operational telemetry needed to identify events across the environment. Threat intelligence is a supplement to log analysis rather than the primary detection mechanism.

Ongoing patch management is an important preventative control that reduces vulnerabilities, but it does not detect or identify security events as they happen. Patch management reduces risk over time and it does not provide continuous monitoring or event correlation.

Regular vulnerability scanning identifies weaknesses at specific points in time and it helps prioritize remediation, but scans are not designed to detect real time incidents or to correlate operational logs. Vulnerability scanning complements but does not replace centralized log collection and analysis for monitoring.

Full AWS Practitioner Certification Question