An assessor identifies automated methods for identifying security control compliance through validating sensors at the endpoint and at Tier 2. Which of the following practices satisfy continuous…

Independent verification and validation is a software engineering quality assurance process focused on confirming system requirements are met, not on continuously monitoring security control compliance.

Security test and evaluation is a structured point-in-time assessment activity, not an automated continuous monitoring practice that provides ongoing control compliance data.

Risk assessment is a periodic analytical process to identify threats and vulnerabilities, not an automated mechanism for continuously monitoring whether security controls remain effective.

Ongoing authorization, defined in NIST SP 800-37 Rev 2, shifts from point-in-time authorization decisions to a continuous monitoring posture where automated sensors provide near-real-time visibility into security control compliance. Validating sensors at the endpoint and Tier 2 directly fulfills this continuous monitoring requirement.