CCSP - Cloud Security Operations - Section 5.6

Manage security operations.

Security operations centre, intelligent monitoring of security controls, log capture and analysis, incident management, and vulnerability assessments.

security operations centre (SOC)intrusion detection and preventionlog capture and analysisincident response lifecyclevulnerability assessment

Practice question for this objective

Free sampleCloud Security Operationsmedium

During an ITIL-aligned review, an operations lead needs to distinguish incident management from problem management. Which statement correctly captures the difference in their primary objectives?

  • AIncident management removes the root cause of recurring faults, while problem management provides a fast temporary workaround to users
  • BIncident management restores normal service operation as quickly as possible, while problem management identifies and removes the underlying cause of one or more incidents Correct
  • CIncident management authorises configuration changes, while problem management maintains the definitive record of approved assets
  • DIncident management measures service-level attainment, while problem management negotiates the service-level agreement with the customer
Distinguish incident management (rapid restoration) from problem management (root-cause elimination) as separate ITIL objectives. ITIL treats an incident as an unplanned interruption whose handling aims to restore service fast, whereas a problem is the underlying cause whose management seeks permanent removal; conflating speed of restoration with root-cause work is the classic error this item targets.

Why A is wrong: This reverses the two disciplines; root-cause removal is problem management and the tempting overlap is that problem management does produce workarounds, but restoration speed belongs to incident management.

Why B is correct: This is the standard ITIL distinction: incident management prioritises rapid service restoration and problem management targets root-cause elimination.

Why C is wrong: These describe change and configuration management respectively, so the statement misattributes both objectives despite sounding process-oriented.

Why D is wrong: Both clauses belong to service-level management, not to the incident or problem processes, so the pairing is tempting but wrong.

See more CCSP practice questions, answers explained.

More in this domain

Back to all Cloud Security Operations objectives, or the CCSP cert hub.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.