CISM Information Security Programme Practice Question
Which TWO of the following are key components of a security operations center (SOC)? (Select TWO)
⚠ Common exam trap
CISM often tests the distinction between preventive controls (vulnerability scanning, IAM) and detective/response controls (monitoring, incident response); candidates may incorrectly include preventive functions as core SOC components.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident response
Incident response (C) is a core SOC component because the SOC's mission includes detecting, containing, eradicating, and recovering from security incidents, typically following a defined IR lifecycle and using tools like SIEM alerts, ticketing, and forensic analysis. Security monitoring and detection (D) is also fundamental, as the SOC continuously collects and correlates telemetry (for example, logs and network flows via a SIEM) to identify suspicious activity and generate alerts that drive response. Vulnerability scanning (A) is a vulnerability management activity often performed by a separate team, even if its output may inform SOC prioritization. Identity and access management (B) is an access-control discipline typically owned by IAM/identity teams, not a defining SOC component. Application security testing (E) belongs to secure development/AppSec functions such as SAST, DAST, and SCA, rather than the SOC's monitoring-and-response core.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vulnerability scanning
Why it's wrong here
Vulnerability scanning identifies weaknesses on a schedule; a SOC's key components are the people, processes and platforms performing continuous monitoring, detection and response. It is tempting because scan output informs SOC triage, yet scanning is a vulnerability management activity, not a core SOC component.
- ✗
Identity and access management
Why it's wrong here
IAM governs who may access which resources, but a SOC's components are monitoring, detection, analysis and response functions such as SIEM, not access control. It is tempting because identity telemetry feeds SOC investigations, yet IAM itself is an operational security control owned outside the SOC.
- ✓
Incident response
Why this is correct
Incident response supplies the SOC's reactive capability: triage, containment, eradication and recovery once detection confirms an event. Without it, monitoring generates alerts with no structured path to resolution, so it is a core operational component alongside detection.
- ✓
Security monitoring and detection
Why this is correct
Security monitoring and detection provide continuous visibility across logs, endpoints and network traffic, identifying anomalous activity that feeds the SOC's analytical pipeline. This detection function is the SOC's foundational purpose, enabling timely escalation before incidents escalate into material breaches.
- ✗
Application security testing
Why it's wrong here
Application security testing is a development-lifecycle control producing findings before deployment, whereas SOC components centre on continuous monitoring, detection and incident response. It is tempting because test results can feed threat intelligence, but testing is not a SOC function; it belongs to secure development and assurance.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.