Which of the following implementations of a continuous monitoring risk mitigation strategy is correct?

Option A diverges from the correct implementation in a specific configuration detail visible in the full text of the choice, making it a subtly incomplete or incorrect continuous monitoring implementation.

Transferring logs only once a month directly violates the 'continuous' requirement and creates unacceptable detection gaps, making near-real-time incident response impossible.

Continuous monitoring per NIST SP 800-137 requires capturing both successful and failed events to detect insider threats and authorized-but-malicious activity, not just failures. Logs must flow to a centralized server on an ongoing basis to support timely detection, and computer-assisted audit reduction is necessary to process log volume at scale without human bottlenecks. This combination satisfies the core requirements of a continuous monitoring program.

Auditing only failed events misses successful but unauthorized actions such as privilege misuse or insider data exfiltration, and manual audit reduction cannot scale to meet continuous monitoring requirements.