CGRC Continuous Monitoring 3

Question 1

Under the NIST RMF, which step explicitly incorporates continuous monitoring activities into the system authorization lifecycle?

Accepted Answer

Step 6 – Monitor

Answer

Step 6 (Monitor) of the NIST RMF is dedicated to ongoing monitoring of security and privacy controls, organizational risk posture, and reporting security status.

Question 2

An organization uses automated tools to continuously collect security data but never analyzes or acts on the reports. Which ISCM principle is being violated?

Accepted Answer

Analyze and report findings

Answer

Collecting data without analysis and action defeats the purpose of ISCM; findings must be reviewed and drive corrective actions.

Question 3

Which type of control assessment is MOST consistent with a mature continuous monitoring program?

Accepted Answer

Automated testing of selected controls on a defined, ongoing schedule

Answer

Mature ISCM programs rely on automated, scheduled testing of controls to provide near-real-time data on control effectiveness.

Question 4

A compliance team wants to demonstrate that their continuous monitoring program supports FedRAMP requirements. Which reporting artifact is most critical?

Accepted Answer

Continuous Monitoring Plan with defined metrics and reporting frequencies

Answer

FedRAMP requires a Continuous Monitoring Plan that specifies which controls are monitored, at what frequency, and how results are reported to the authorizing official.

Question 5

What is the role of the 'security status report' in an ISCM program?

Accepted Answer

It communicates the current state of implemented controls and risk posture to authorizing officials

Answer

The security status report provides authorizing officials with timely updates on control effectiveness, vulnerabilities, and overall risk so they can make informed ongoing authorization decisions.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Continuous Monitoring 3