FedRAMP Risk Management Framework & Assessment 2

Question 1

Which NIST publication specifically defines the Risk Management Framework (RMF) steps used in FedRAMP?

Accepted Answer

NIST SP 800-37

Answer

NIST SP 800-37, 'Guide for Applying the Risk Management Framework to Federal Information Systems,' defines the six RMF steps that FedRAMP is built upon.

Question 2

In FedRAMP, which step of the RMF involves selecting and tailoring security controls based on the system's categorization?

Accepted Answer

Select

Answer

The Select step involves choosing appropriate security controls from NIST SP 800-53 and applying FedRAMP baselines and overlays based on the system's impact level.

Question 3

A CSP's system stores federal tax records for millions of citizens. Under FIPS 199, which impact level is most appropriate?

Accepted Answer

High

Answer

Systems storing sensitive federal data like tax records affecting millions of citizens typically warrant a High impact categorization due to severe consequences if compromised.

Question 4

What does the term 'residual risk' mean in the context of FedRAMP risk assessments?

Accepted Answer

Risk that remains after security controls have been applied

Answer

Residual risk is the remaining risk exposure after all planned or implemented security controls have been applied to mitigate or reduce the initial risk.

Question 5

Which document formally records the security control implementation details for a FedRAMP system?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan (SSP) is the primary document describing how each security control is implemented, who is responsible, and the system's security posture.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Risk Management Framework & Assessment 2