FedRAMP FedRAMP Third-Party Assessment & Supply Chain 2

Question 1

Which NIST publication specifically addresses supply chain risk management for federal information systems?

Accepted Answer

NIST SP 800-161

Answer

NIST SP 800-161 (Cybersecurity Supply Chain Risk Management Practices) specifically addresses managing supply chain risks for federal systems.

Question 2

When a 3PAO conducts penetration testing for a FedRAMP assessment, what is the primary objective?

Accepted Answer

To attempt to exploit vulnerabilities and validate whether security controls prevent unauthorized access

Answer

FedRAMP penetration testing attempts to exploit identified vulnerabilities to determine if security controls effectively prevent unauthorized access.

Question 3

What is the purpose of an interconnection security agreement (ISA) in the FedRAMP context?

Accepted Answer

To formally document the security requirements and responsibilities when two systems share data or connectivity

Answer

An ISA formally defines the security controls, data flows, and responsibilities when a FedRAMP system connects to another system.

Question 4

What FedRAMP supply chain control requires CSPs to assess and manage risks from open-source software components?

Accepted Answer

SA-12 (Supply Chain Protection) and related controls requiring software bill of materials practices

Answer

FedRAMP's SA-12 and related supply chain controls require CSPs to identify and manage risks from all software components, including open-source libraries.

Question 5

What is a Software Bill of Materials (SBOM) and why is it important in FedRAMP supply chain security?

Accepted Answer

An inventory of software components and dependencies that helps identify vulnerable or malicious code in the supply chain

Answer

An SBOM is a comprehensive inventory of all software components, enabling identification and response to vulnerabilities in third-party dependencies.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP FedRAMP Third-Party Assessment & Supply Chain 2