FedRAMP Cloud Security & Governance 4

Question 1

Which FIPS standard governs the encryption algorithms approved for protecting federal data in FedRAMP-authorized systems?

Accepted Answer

FIPS 140-2/140-3

Answer

FIPS 140-2 (and its successor FIPS 140-3) specifies requirements for cryptographic modules used to protect sensitive federal information.

Question 2

In FedRAMP, what categorization standard determines whether a system is Low, Moderate, or High impact?

Accepted Answer

FIPS 199

Answer

FIPS 199 defines standards for security categorization of federal information and information systems based on confidentiality, integrity, and availability impact levels.

Question 3

What is a FedRAMP 'inherited control' in the context of a SaaS built on an IaaS platform?

Accepted Answer

A control implemented by the underlying IaaS that the SaaS can rely upon

Answer

Inherited controls are security controls already implemented by an underlying platform (e.g., IaaS/PaaS) that a higher-layer service can leverage rather than re-implement.

Question 4

Which FedRAMP requirement addresses supply chain risk management for cloud service providers?

Accepted Answer

SA-12 Supply Chain Protection control family

Answer

The SA-12 (and broader SA control family) addresses supply chain protection, requiring CSPs to manage risks from third-party components, software, and services.

Question 5

What is the purpose of the FedRAMP Security Assessment Framework (SAF)?

Accepted Answer

To provide a uniform approach for assessing cloud services against FedRAMP requirements

Answer

The FedRAMP SAF provides a standardized methodology for how 3PAOs assess and document CSP compliance with FedRAMP security controls.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Cloud Security & Governance 4