Which two subjects does SP 800-137 say training for monitoring roles may cover? Choose two.

Answer: C. Establishing baselines and tuning measurements so monitoring reflects the operational environment
D. Recognising and responding appropriately to alerts indicating risk beyond acceptable limits

SP 800-137 says training may include management and use of automated tools such as establishing baselines and tuning measurements, recognition of and response to triggers and alerts from metrics indicating risk beyond acceptable limits, and reporting requirements.

Source: NIST SP 800-137 (NIST) — Sec. 3.1.1 Organization and Mission Tier Strategy