Which two checks does NIST describe under continuous monitoring within the configuration management process? Choose two.

Answer: A. Configuration verification tests confirming the configuration has not been altered outside the process
D. System audits examining the system and its documentation against the approved baseline

SP 800-100 states agencies can achieve continuous monitoring goals by performing configuration verification tests to ensure the selected configuration has not been altered outside the process, and by performing system audits against the approved baseline.

Source: NIST SP 800-100 (NIST) — Sec. 14.3 Step 5 Continuous Monitoring