CAP Continuous Monitoring Strategy

Question 1

What is the primary goal of continuous monitoring in the context of the RMF?

Accepted Answer

To maintain ongoing situational awareness of the security state of information systems and detect changes that affect risk

Answer

To replace annual FISMA reporting with automated tools

Answer

To eliminate the need for periodic security assessments

Answer

To automate the granting of ATOs without AO review

Question 2

Which NIST publication provides the primary guidance for information security continuous monitoring (ISCM)?

Accepted Answer

NIST SP 800-137

Answer

NIST SP 800-53

Answer

NIST SP 800-37

Answer

NIST SP 800-30

Question 3

What are the six steps of the ISCM process defined in NIST SP 800-137?

Accepted Answer

Define, Establish, Implement, Analyze/Report, Respond, Review/Update

Answer

Plan, Do, Check, Act, Monitor, Report

Answer

Identify, Protect, Detect, Respond, Recover, Adapt

Answer

Prepare, Categorize, Select, Implement, Assess, Authorize

Question 4

What is a Security Information and Event Management (SIEM) system's primary role in continuous monitoring?

Accepted Answer

To aggregate, correlate, and analyze security event logs from across the enterprise in near real-time

Answer

To replace firewalls with AI-driven packet inspection

Answer

To generate the System Security Plan automatically

Answer

To serve as the primary vulnerability scanner

Question 5

What is the purpose of defining monitoring frequencies in a continuous monitoring strategy?

Accepted Answer

To establish how often each control is assessed based on its volatility, importance, and available resources

Answer

To set how many times per year the AO must review the system

Answer

To define the schedule for penetration tests only

Answer

To comply with mandatory daily scanning requirements

Question 6

How does continuous monitoring support the 'Monitor' step of the RMF?

Accepted Answer

By providing ongoing assessment of controls, documenting changes, and reporting security status to the AO

Answer

By generating the initial SSP before authorization

Answer

By replacing the need for the security assessment report

Answer

By automating POA&M remediation without human involvement