CompTIA Security+ (SY0-701)Security Program Management and OversightHard
An organization implements automated tools that continuously scan cloud configurations against a defined security baseline and generate real-time alerts whenever a resource drifts out of compliance. Which concept does this practice represent?
- AVendor risk assessment
- BContinuous compliance monitoring
- CAnnual compliance audit
- DPenetration testing
Show answer & explanationAnswer & explanation
Correct answer: B. Continuous compliance monitoring
Continuous compliance monitoring uses automated tools to constantly evaluate systems against defined baselines or policies, providing real-time detection of configuration drift, rather than relying solely on periodic, point-in-time audits.
Why the other options are wrong
- A. Vendor risk assessment evaluates third-party security posture, not internal cloud configuration drift.
- C. An annual compliance audit is a periodic, point-in-time review, not a continuous automated process.
- D. Penetration testing actively attempts to exploit vulnerabilities, unrelated to configuration baseline checks.
Continuous Compliance Monitoring
The ongoing, automated evaluation of systems and configurations against defined security baselines to detect and alert on non-compliance in real time.
- Contrasts with periodic audits by providing near real-time visibility
- Often implemented via cloud security posture management (CSPM) tools
- Helps quickly identify and remediate configuration drift
Memory trick: Continuous = always watching, not just once a year