hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Implementing a continuous monitoring program for…
A company is implementing a continuous monitoring program for its cloud infrastructure. Which of the following metrics would be MOST useful for detecting unauthorized changes to production systems?
⚠ Common exam trap
A common mix-up: candidates choose 'Number of failed login attempts per hour' (Option C) because they associate monitoring with authentication events, but the question specifically targets unauthorized changes to production systems, which require integrity-focused metrics like configuration drift, not access attempts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configuration drift from a known good baseline.
Configuration drift from a known good baseline is the most effective metric for detecting unauthorized changes because it directly compares the current state of production systems against a secure, approved baseline (e.g., using tools like AWS Config, Azure Policy, or Chef InSpec). Any deviation—such as altered file permissions, unexpected services, or modified registry keys—triggers an alert, enabling rapid detection of unauthorized modifications. This aligns with continuous monitoring principles in cloud security, focusing on integrity rather than performance or access patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Network throughput between application tiers.
Why it's wrong here
Monitoring network throughput primarily assesses network performance and availability, indicating the volume of data transferred between application components. While sudden, drastic changes might indirectly suggest an issue, it does not directly identify unauthorized modifications to system configurations, software installations, or security settings. This metric is more relevant for performance optimization or detecting denial-of-service attacks than for configuration integrity.
- ✗
Average CPU load across all systems.
Why it's wrong here
Average CPU load across systems is a key performance indicator reflecting the computational demands placed on processors. Significant spikes or sustained high loads typically point to performance bottlenecks, resource exhaustion, or potentially malware execution consuming resources. However, it does not inherently reveal unauthorized configuration changes, software installations, or modifications to security policies, which are the direct targets of continuous monitoring for integrity.
- ✗
Number of failed login attempts per hour.
Why it's wrong here
The number of failed login attempts per hour is a critical security metric for detecting potential brute-force attacks, account enumeration, or unauthorized access attempts. While an increase signifies malicious activity targeting user accounts, it does not directly monitor or identify unauthorized modifications to system configurations, installed software, or security baselines. This metric focuses on authentication integrity rather than system configuration integrity.
- ✓
Configuration drift from a known good baseline.
Why this is correct
Configuration drift from a known good baseline is a direct and highly effective indicator for detecting unauthorized changes within a continuous monitoring program. This process involves regularly comparing the current state of system configurations, including operating system settings, application parameters, and security policies, against a pre-approved, secure baseline. Any deviation immediately flags a potential unauthorized modification, ensuring system integrity and compliance are maintained proactively.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.