FedRAMP Continuous Monitoring & Incident Response 4

Question 1

Which FedRAMP ConMon deliverable must CSPs submit to the FedRAMP PMO on a monthly basis?

Accepted Answer

Vulnerability scan results and updated POA&M

Answer

CSPs must submit monthly vulnerability scan results and an updated POA&M to demonstrate ongoing remediation progress.

Question 2

During incident response containment, a CSP isolates a compromised virtual machine. Which action should occur FIRST before isolation?

Accepted Answer

Capture forensic memory image and logs

Answer

Forensic preservation of volatile evidence (memory, logs) must occur before isolation to avoid losing critical investigation data.

Question 3

A CSP operating under a FedRAMP ATO discovers a zero-day vulnerability in a core component. What is the FIRST required action?

Accepted Answer

Notify the AO and agency customers per the incident response plan

Answer

Zero-day vulnerabilities with active exploitation risk must be reported to the AO and affected agencies immediately per the incident response plan before other remediation steps.

Question 4

In FedRAMP ConMon, what distinguishes an 'operational requirement' deviation from a 'risk acceptance' deviation?

Accepted Answer

Operational requirements justify why a control cannot be implemented; risk acceptances acknowledge a known weakness will remain

Answer

An operational requirement deviation explains why a control is technically not implementable, while a risk acceptance acknowledges an implementable control is knowingly not being applied.

Question 5

Which continuous monitoring capability is specifically required for FedRAMP High systems but NOT explicitly mandated for Moderate systems?

Accepted Answer

Daily automated vulnerability scanning

Answer

FedRAMP High requires daily automated vulnerability scanning of databases and web applications, exceeding the Moderate requirement.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Continuous Monitoring & Incident Response 4