CGRC Continuous Monitoring 5

Question 1

A system owner receives a security status report showing a high-risk finding that has been open for 90 days with no remediation progress. What ISCM process should be triggered?

Accepted Answer

Escalation to the authorizing official with a revised POA&M and risk acceptance decision

Answer

Unresolved high-risk findings must be escalated to the AO, who can require accelerated remediation, accept residual risk, or revoke authorization.

Question 2

What is the primary benefit of integrating threat intelligence feeds into a continuous monitoring program?

Accepted Answer

Providing context about active threats to prioritize monitoring and response activities

Answer

Threat intelligence feeds help organizations understand which threats are actively targeting their sector, allowing them to prioritize monitoring efforts on the most relevant risks.

Question 3

Under FISMA, how frequently must agencies report security status to OMB and DHS?

Accepted Answer

Annually

Answer

FISMA requires federal agencies to report their security posture to OMB and DHS annually, though continuous monitoring data informs those reports.

Question 4

Which approach BEST supports continuous monitoring in a DevSecOps pipeline?

Accepted Answer

Embedding automated security testing and compliance checks at every stage of the CI/CD pipeline

Answer

Embedding automated security checks throughout the CI/CD pipeline (shift-left) enables continuous monitoring from code commit through deployment, catching issues early.

Question 5

An ISCM program identifies that a critical control is consistently failing across multiple systems but no corrective action has been taken for months. What organizational issue does this most likely reflect?

Accepted Answer

A lack of governance mechanisms to drive remediation from monitoring findings to closure

Answer

When findings persist without remediation, the root cause is typically a governance gap — no clear ownership, accountability, or escalation process to turn monitoring data into action.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Continuous Monitoring 5