CAP Continuous Monitoring Strategy 2

Question 1

What is an 'ongoing authorization' in the context of continuous monitoring?

Accepted Answer

A risk management approach where the AO makes ongoing authorization decisions based on real-time monitoring data rather than periodic reassessments

Answer

Ongoing authorization shifts from periodic reauthorization to a continuous risk-informed process where the AO monitors security posture in real time.

Question 2

What is the role of automated scanning tools in a continuous monitoring program?

Accepted Answer

To efficiently collect security state data such as patch levels, configuration compliance, and vulnerabilities at scale

Answer

Automated tools enable continuous data collection across large environments, making it feasible to assess many controls frequently without manual effort.

Question 3

What federal initiative provides automated continuous monitoring capabilities and dashboards to federal civilian agencies?

Accepted Answer

Continuous Diagnostics and Mitigation (CDM)

Answer

The CDM program, managed by CISA, provides tools and dashboards to automate continuous monitoring across federal civilian agencies.

Question 4

What should happen when continuous monitoring detects a significant security change to a system?

Accepted Answer

The ISSO must notify the AO and update the SSP and risk assessment to reflect the new security posture

Answer

Significant changes detected during monitoring must be reported to the AO, and associated documentation must be updated to reflect the current risk posture.

Question 5

Which metric is commonly used to measure the effectiveness of a vulnerability management continuous monitoring process?

Accepted Answer

Mean Time to Remediate (MTTR) critical vulnerabilities

Answer

MTTR measures how quickly identified vulnerabilities are patched, directly reflecting the effectiveness of the vulnerability management process.

CAP - Certified Accreditation Professional Practice Test

CAP - Certified Accreditation Professional Practice Test

CAP Continuous Monitoring Strategy 2