CISSP Security Assessment and Testing Practice Question
A security manager is designing a continuous monitoring program to satisfy ongoing authorization requirements. The program must detect unauthorized configuration changes to production servers, verify that security patches are applied within policy timeframes, and provide evidence for auditors. Which TWO of the following controls BEST support these objectives? (Choose two.)
⚠ Common exam trap
The trap here is equating periodic assessments such as quarterly scans or annual penetration tests with continuous monitoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security information and event management (SIEM) correlation of change logs, patch deployment records, and FIM alerts with retention aligned to the audit period
Continuous monitoring requires automated, recurrent detection of change and patch state plus a durable evidence repository. File integrity monitoring detects unauthorized modifications against a baseline, while a SIEM correlates change, patch, and integrity data and retains it for audit review. Manual records and periodic scanning or testing cannot deliver the required continuous detection or evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A vulnerability scanner scheduled to run quarterly against all production servers with results emailed to the security team
Why it's wrong here
Quarterly scanning is too infrequent for continuous monitoring and provides only point-in-time snapshots. It may identify missing patches but cannot detect unauthorized configuration changes between scans, and emailed results alone do not constitute a reliable evidence trail. The cadence and detection capability do not meet the stated objectives.
- ✓
Security information and event management (SIEM) correlation of change logs, patch deployment records, and FIM alerts with retention aligned to the audit period
Why this is correct
A SIEM aggregates and correlates FIM alerts, patch deployment records, and change management logs, providing the centralized detection and evidence repository continuous monitoring requires. Retention aligned to the audit period ensures auditors can review historical events, and correlation surfaces changes that lack an approved change record.
- ✗
A configuration management database (CMDB) updated manually by administrators when changes are made
Why it's wrong here
A manually updated CMDB depends on administrators accurately recording changes, which is unreliable and cannot detect unauthorized modifications made outside the change process. It documents intended state rather than verifying actual state, so it fails to detect drift and provides weak audit evidence for continuous monitoring.
- ✗
Annual penetration testing of the production environment performed by an external firm
Why it's wrong here
Annual penetration testing is a point-in-time assessment and does not provide continuous detection of configuration changes or patch status. It is valuable for validating exploitability but cannot alert on unauthorized modifications as they occur, so it does not satisfy the stated continuous monitoring objectives.
- ✓
File integrity monitoring (FIM) that baselines critical system files and alerts on unauthorized modifications
Why this is correct
FIM establishes a known-good baseline of critical files such as binaries, configuration files, and registry keys, then alerts when they change. This directly detects unauthorized configuration changes to production servers, supports patch verification by flagging altered binaries, and produces timestamped alerts that serve as audit evidence of monitoring activity.
Go deeper
Related to this question
Learn chapter
Physical Security and Environmental Controls
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.