Compliance Maintenance

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

Which of the following activities is a core component of the 'Ongoing Authorization' process?