CGRC Continuous Monitoring 4

Question 1

Which tool category provides the broadest visibility into real-time security events across an enterprise for continuous monitoring purposes?

Accepted Answer

Security Information and Event Management (SIEM)

Answer

A SIEM aggregates and correlates log and event data from across the enterprise, providing the broadest real-time visibility for continuous monitoring.

Question 2

In a cloud-shared responsibility model, which continuous monitoring activities remain the customer's responsibility even when using an IaaS provider?

Accepted Answer

Monitoring of operating systems, applications, and data the customer deploys

Answer

In IaaS, the provider secures the underlying infrastructure, but the customer is responsible for monitoring their own OS, applications, and data.

Question 3

A financial services firm must comply with both FISMA and PCI DSS. How should their ISCM program address overlapping control requirements?

Accepted Answer

Leverage a unified monitoring program that maps common controls to both frameworks simultaneously

Answer

A unified ISCM program with control mapping reduces duplication of effort by assessing shared controls once and satisfying multiple framework requirements.

Question 4

What is 'configuration drift' in the context of continuous monitoring?

Accepted Answer

Unauthorized or undocumented changes to system configurations that deviate from the approved baseline

Answer

Configuration drift occurs when systems deviate from their approved secure baseline over time due to unauthorized changes, patches, or incremental modifications.

Question 5

Which stakeholder is ultimately responsible for accepting residual risk identified through continuous monitoring activities?

Accepted Answer

Authorizing Official (AO)

Answer

The Authorizing Official (AO) holds accountability for accepting residual risk and maintaining the system's authorization to operate.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Continuous Monitoring 4