Compliance Maintenance

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Which of the following activities is a core component of the 'Ongoing Authorization' process?

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?