FedRAMP Continuous Monitoring & Incident Response 2

Question 1

Under FedRAMP, how frequently must High-impact systems submit an automated vulnerability scan of their operating system/infrastructure?

Accepted Answer

Weekly

Answer

FedRAMP High systems must perform OS/infrastructure vulnerability scans weekly.

Question 2

What is the maximum allowable time for a FedRAMP-authorized CSP to report a security incident to US-CERT after discovery?

Accepted Answer

24 hours

Answer

FedRAMP requires CSPs to report incidents to US-CERT within 1 hour of discovery for High systems, but the general threshold across impact levels is within 1 hour per NIST SP 800-61.

Question 3

Which FedRAMP document formalizes the ongoing relationship between a CSP and its authorizing official for continuous monitoring?

Accepted Answer

Continuous Monitoring Strategy

Answer

The Continuous Monitoring Strategy document formalizes the ongoing monitoring activities and responsibilities between the CSP and AO.

Question 4

A CSP discovers that an attacker exfiltrated data from a FedRAMP system. Which incident response phase focuses on removing the attacker's foothold?

Accepted Answer

Eradication

Answer

The Eradication phase involves removing the root cause of the incident, including malware and attacker access.

Question 5

In FedRAMP continuous monitoring, what triggers a requirement for an updated security assessment rather than routine monitoring?

Accepted Answer

A significant change to the system

Answer

Significant changes to a FedRAMP system require an updated security assessment to re-evaluate risk.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Continuous Monitoring & Incident Response 2