Compliance Maintenance

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Which of the following activities is a core component of the 'Ongoing Authorization' process?

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

You are the GRC lead for a U.S. federal agency. A system has an Authorization to Operate (ATO) that expires in 90 days. The system owner submits a revised System Security Plan (SSP) and a new security assessment report showing all controls are still effective, but no changes have been made to the system since the last authorization. According to NIST SP 800-37 Rev. 2, what is the most appropriate action to maintain the authorization?

A security engineer is using the NIST Risk Management Framework (RMF) to maintain compliance for a high-impact system. During continuous monitoring, the engineer discovers that a critical security control has been modified without a security impact analysis. Which of the following actions should the engineer take FIRST?

You are a GRC analyst responsible for continuous monitoring of a federal information system. The system has a current ATO and is in the operations and maintenance phase. Which TWO of the following activities are required to maintain the authorization according to NIST SP 800-37 Rev. 2? (Choose two.)

You are the GRC analyst for a system that has an approved Authorization to Operate (ATO). A new vulnerability is discovered in a component that is not part of the system's boundary but is used by the system's administrators. According to continuous monitoring principles, what should you do first?

A system's continuous monitoring plan requires weekly vulnerability scans. The scans have been consistently showing the same findings for three months, and remediation efforts have been unsuccessful due to vendor delays. What should the GRC analyst do?

As the GRC analyst, you are reviewing the continuous monitoring program for a financial system that processes transactions. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which of the following is the MOST appropriate action?

During continuous monitoring, you discover that a security control has been implemented differently than described in the system security plan (SSP). The control is still effective, but the implementation details are outdated. What should you do?

A GRC analyst is updating the system security plan (SSP) after a major change to a system's boundary. Which of the following should be the PRIMARY focus of the update?

A financial services firm operates a system processing customer credit data under an active Authority to Operate (ATO). A quarterly review shows that a recent operating system upgrade altered the configuration of the audit logging service, causing it to stop forwarding events to the central log server. The GRC analyst must determine the correct action to maintain the system's security posture and ATO validity. What should the analyst do FIRST?

A GRC analyst is reviewing the continuous monitoring strategy for a high-impact system. The system owner proposes reducing the frequency of vulnerability scans from weekly to monthly to save resources. Which TWO factors should the analyst consider when evaluating this proposal? (Choose two.)

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner wants to use automated tools to collect and analyze security-related data. Which of the following should the analyst ensure is in place to support this automation?

A federal information system has an approved Authority to Operate (ATO) with an expiration date of 18 months from now. The system owner asks you, the GRC analyst, what triggers a reauthorization before that date. Which of the following events most clearly requires a reauthorization decision by the Authorizing Official?

During continuous monitoring, you discover that a security control that was previously assessed as effective is now failing because the responsible team stopped performing the control due to staff turnover. The control is critical for protecting sensitive data. What is the most appropriate immediate action for the GRC analyst to take?

You are reviewing the continuous monitoring strategy for a system that processes Controlled Unclassified Information (CUI). The system owner proposes reducing the frequency of vulnerability scans from weekly to quarterly to save costs. As the GRC analyst, what is your primary consideration when evaluating this proposal?

A GRC analyst is reviewing the continuous monitoring results for a system that has been in operation for two years. The analyst notices that a security control for access control (AC-2) has been consistently failing automated checks for the past three months. The system owner argues that the control is not critical and wants to accept the risk. What is the most appropriate action for the analyst to take?

A GRC officer is preparing for an annual assessment of a system's continuous monitoring program. The officer must ensure that the program's documentation reflects the current state of security controls. Which of the following artifacts is MOST important to review to verify that the continuous monitoring program is effectively tracking control changes?

You are conducting a security impact analysis for a proposed change to a system that has an existing Authority to Operate (ATO). The change involves migrating the database to a new cloud service provider. Which TWO of the following factors are most critical to evaluate in this analysis? (Choose two.)

A GRC analyst is evaluating the effectiveness of a continuous monitoring program for a system that has been operational for two years. The analyst notices that several security controls have not been assessed since the initial authorization. Which of the following is the MOST likely cause of this issue?

After a system receives an Authority to Operate (ATO), the organization must maintain compliance through continuous monitoring. Which of the following activities is a core component of a continuous monitoring program?

A GRC analyst is supporting the ongoing authorization of a system that has been designated as high-impact. The authorizing official has requested evidence that the continuous monitoring program is providing adequate visibility into the system's security posture. Which of the following activities BEST demonstrates that the program is effectively supporting ongoing authorization?

A federal system has received an authorization to operate (ATO) with a continuous monitoring strategy that requires monthly vulnerability scans and annual security assessments. Six months into the authorization, the system owner replaces the primary database server with a newer model running a different operating system version. The security control baseline remains the same. As the GRC analyst supporting the ongoing authorization, what is the MOST appropriate action to maintain compliance?

A GRC analyst is supporting a system that has been authorized to operate. The continuous monitoring program includes automated configuration scans, annual control assessments, and a plan of action and milestones (POA&M). During a quarterly review, the analyst finds that several POA&M items have exceeded their original completion dates. The system owner wants to know which actions are required to maintain compliance. (Choose two.)

A GRC analyst is reviewing the continuous monitoring strategy for a system that has been authorized to operate. The system owner asks which document should be updated to reflect changes in the system's security posture resulting from continuous monitoring activities. What is the PRIMARY document that must be kept current?