Which concept involves continuously identifying threats and monitoring unexpected network changes to prevent breaches?

• A. Continuous Monitoring
• B. Threat Hunting
• C. Penetration Testing
• D. Compliance Auditing

Answer: (A)

Continuous monitoring is the ongoing collection, correlation, and analysis of security telemetry from across the network, endpoints, and applications to spot threats and unusual changes as soon as they occur. By continuously watching for deviations from established baselines—like strange logins, unusual data flows, or unauthorized configuration changes—you can generate alerts and trigger quick responses to contain incidents before they become breaches. This proactive, real-time visibility is what lets defenders stay ahead of attackers rather than waiting for a one-off test or audit to reveal problems.

Threat hunting involves proactive searches for stealthy adversaries, but it’s typically a targeted, investigation-driven activity rather than a constant, system-wide monitoring process. Penetration testing is a controlled, time-bound exercise to discover vulnerabilities, not an ongoing monitoring program. Compliance auditing checks adherence to policies and standards, not real-time threat detection.