CompTIA CASP+ Practice Test

Which is a correct implementation of a continuous monitoring risk mitigation strategy?

1. Audit events weekly and review findings monthly

2. Transfer logs daily but do not display alerts

3. Audit successful and failed events, transfer logs to a centralized server

4. Implement real-time alerts only for successful events

The correct answer is: Audit successful and failed events, transfer logs to a centralized server

A correct implementation of a continuous monitoring risk mitigation strategy focuses on thoroughness and ongoing oversight. This involves not only the collection of security logs but also the analysis of both successful and failed events to gain a comprehensive view of the security posture. By auditing both types of events, an organization can identify potential vulnerabilities and threats that may arise from successful breaches as well as attempted intrusions that were blocked. Transferring logs to a centralized server enhances the ability to analyze data efficiently and in a more organized manner, allowing for better insights and quicker responses. Centralized log management is crucial for continuous monitoring as it facilitates aggregation, correlation, and a more comprehensive analysis of security incidents over time, rather than relying on isolated data. In contrast, strategies that focus solely on certain types of events, review periods that are infrequent, or inadequate alerting mechanisms do not provide the level of continuous oversight that effective risk mitigation requires. This is why the other options do not align with the principles of a robust continuous monitoring strategy.