The correct answer is Designing a backup and recovery policy.

Designing a backup and recovery policy is not an explicit step in the NIST SP 800-137 continuous monitoring process because continuous monitoring is focused on defining a monitoring strategy, selecting and implementing metrics, collecting and analyzing security-related data, and responding to findings. Backup and recovery belongs to contingency planning and business continuity activities and is addressed in other NIST guidance.

Selecting suitable metrics is incorrect because SP 800-137 explicitly requires organizations to select metrics that measure security posture and the effectiveness of controls as part of the continuous monitoring process.

Cloud Monitoring and Logging is incorrect because the continuous monitoring process covers implementation of monitoring and logging across operational environments, including cloud services, as part of data collection and analysis.

Establishing a monitoring strategy is incorrect because SP 800-137 calls for establishing a monitoring strategy or plan as an initial step to set scope, roles, responsibilities, and the approach to metrics and data collection.

Full AWS Practitioner Certification Question