FedRAMP Cloud Security & Governance 3

Question 1

What is the minimum frequency required for vulnerability scanning of operating systems under FedRAMP Moderate baseline?

Accepted Answer

Monthly

Answer

FedRAMP Moderate requires OS vulnerability scans at least monthly, with web application and database scans also on a monthly basis.

Question 2

In FedRAMP governance, which entity is responsible for issuing a Provisional Authority to Operate (P-ATO)?

Accepted Answer

Joint Authorization Board (JAB)

Answer

The Joint Authorization Board, composed of CIOs from DoD, DHS, and GSA, issues Provisional ATOs for cloud services with government-wide use potential.

Question 3

Which FedRAMP program allows low-risk SaaS applications to achieve authorization using a smaller, tailored set of controls?

Accepted Answer

FedRAMP Tailored (LI-SaaS)

Answer

FedRAMP Tailored LI-SaaS provides a reduced control set for low-impact software-as-a-service that processes only non-sensitive, publicly available information.

Question 4

What does 'continuous monitoring' mean in the context of FedRAMP authorization maintenance?

Accepted Answer

Ongoing assessment of security controls to maintain ATO over time

Answer

FedRAMP continuous monitoring is an ongoing program of security assessments, vulnerability management, and reporting to maintain an authorization's validity.

Question 5

Under FedRAMP, how must a CSP report a significant security incident to the federal government?

Accepted Answer

Within 1 hour to US-CERT and affected agencies

Answer

FedRAMP requires CSPs to report major incidents to US-CERT and affected agencies within one hour of detection.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Cloud Security & Governance 3