FedRAMP Continuous Monitoring & Incident Response 3

Question 1

Which NIST publication provides the primary guidance for continuous monitoring strategies referenced by FedRAMP?

Accepted Answer

NIST SP 800-137

Answer

NIST SP 800-137, 'Information Security Continuous Monitoring for Federal Information Systems,' is the primary guide for ConMon.

Question 2

A FedRAMP CSP's web application scanner finds a critical vulnerability. What is the maximum remediation timeframe allowed by FedRAMP for critical/high vulnerabilities on a Moderate system?

Accepted Answer

30 days

Answer

FedRAMP requires remediation of critical and high vulnerabilities within 30 days for Moderate impact systems.

Question 3

During the 'lessons learned' step of incident response, what is the primary output?

Accepted Answer

A post-incident report with process improvements

Answer

The post-incident report documents what happened, what worked, what didn't, and recommendations for improving the incident response process.

Question 4

Which metric best demonstrates the effectiveness of a FedRAMP continuous monitoring program over time?

Accepted Answer

Mean time to remediate identified vulnerabilities

Answer

Mean time to remediate (MTTR) measures how quickly vulnerabilities are resolved, directly indicating ConMon program effectiveness.

Question 5

Under FedRAMP, who is authorized to perform the independent annual security assessment of a cloud service offering?

Accepted Answer

A FedRAMP-accredited Third-Party Assessment Organization (3PAO)

Answer

Only FedRAMP-accredited 3PAOs may perform the independent security assessments required for initial and ongoing FedRAMP authorization.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Continuous Monitoring & Incident Response 3