FedRAMP Cloud Security & Governance 2

Question 1

Which FedRAMP impact level is required for cloud systems processing information where loss of confidentiality could cause severe or catastrophic harm to national security?

Accepted Answer

High

Answer

FedRAMP High is required when unauthorized disclosure could cause severe or catastrophic adverse effects on national security, government operations, or individuals.

Question 2

In FedRAMP, what is the purpose of the Plan of Action and Milestones (POA&M)?

Accepted Answer

Track and manage remediation of security weaknesses

Answer

A POA&M documents identified security weaknesses, their risk levels, and the planned corrective actions with target completion dates.

Question 3

What NIST publication serves as the primary source for the security control baselines used in FedRAMP?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the catalog of security and privacy controls from which FedRAMP derives its Low, Moderate, and High baselines.

Question 4

Which cloud deployment model is most commonly associated with FedRAMP authorizations?

Accepted Answer

Public cloud or government community cloud

Answer

FedRAMP primarily governs public cloud and government community cloud services used by federal agencies to store, process, or transmit federal data.

Question 5

What is the role of a Third Party Assessment Organization (3PAO) in the FedRAMP process?

Accepted Answer

Independently assesses and validates a CSP's security controls

Answer

A 3PAO is an accredited independent assessor that evaluates whether a CSP's security controls meet FedRAMP requirements.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Cloud Security & Governance 2