CAP Continuous Monitoring and System Lifecycle 2 — Questions and Answers
Question 1: The System Development Life Cycle (SDLC) is important in security because integrating security early follows which principle?
- Defense in depth
- Security by obscurity
- Shift left / security by design (Correct answer)
- Least privilege
Correct answer: Shift left / security by design
Integrating security requirements and controls from the earliest SDLC phases (shifting left) is more effective and less costly than retrofitting security later.
Question 2: During which SDLC phase is the System Security Plan typically first developed?
- Disposal
- Operations and Maintenance
- Development/Acquisition
- Initiation (Correct answer)
Correct answer: Initiation
The SSP is initiated during the Initiation phase when system boundaries, requirements, and preliminary security controls are first identified.
Question 3: What security activity must be performed before a system is decommissioned during the SDLC Disposal phase?
- A new ATO must be granted
- Media sanitization and data destruction per NIST SP 800-88 (Correct answer)
- A privacy threshold analysis only
- All user accounts must be documented in the SSP
Correct answer: Media sanitization and data destruction per NIST SP 800-88
NIST SP 800-88 provides guidelines for media sanitization to ensure sensitive information cannot be recovered after system disposal.
Question 4: Which continuous monitoring activity involves testing a subset of controls each year rather than all controls simultaneously?
- Penetration testing
- Rolling assessments (Correct answer)
- Baseline reconfiguration
- Risk acceptance
Correct answer: Rolling assessments
Rolling assessments divide the full control set into groups assessed on a rotating schedule, providing continuous coverage without full annual assessments.
Question 5: What is the purpose of a hardware and software inventory in continuous monitoring?
- To assign user access rights
- To maintain an accurate record of system components to detect unauthorized assets (Correct answer)
- To document financial depreciation
- To satisfy FedRAMP marketing requirements
Correct answer: To maintain an accurate record of system components to detect unauthorized assets
Maintaining an accurate inventory is fundamental to continuous monitoring, enabling detection of unauthorized or unknown assets that pose security risks.
Question 6: Vulnerability scanning in a continuous monitoring program is primarily used to identify what?
- User behavior anomalies
- Known software weaknesses, missing patches, and configuration errors (Correct answer)
- Network bandwidth usage
- Employee access patterns
Correct answer: Known software weaknesses, missing patches, and configuration errors
Automated vulnerability scans identify unpatched software, misconfigurations, and known exploitable weaknesses across the system.
CAP Continuous Monitoring and System Lifecycle 2
The System Development Life Cycle (SDLC) is important in security because integrating security early follows which principle?