FedRAMP Risk Management Framework & Assessment 3

Question 1

A 3PAO discovers that a CSP has a control that is 'planned but not yet implemented.' How should this be reflected in the FedRAMP package?

Accepted Answer

Document it in the POA&M with target completion dates

Answer

Controls that are planned but not yet implemented must be tracked in the Plan of Action & Milestones (POA&M) with specific milestones and target remediation dates.

Question 2

What is the maximum timeframe FedRAMP generally allows for remediating a 'High' severity vulnerability discovered during continuous monitoring?

Accepted Answer

30 days

Answer

FedRAMP requires that High severity vulnerabilities be remediated within 30 days of discovery during continuous monitoring activities.

Question 3

Under the FedRAMP Moderate baseline, approximately how many security controls must a CSP implement and document?

Accepted Answer

~325 controls

Answer

The FedRAMP Moderate baseline requires implementation of approximately 325 security controls drawn from NIST SP 800-53 Rev 5.

Question 4

Which concept describes the practice of combining multiple FedRAMP-authorized services to build a larger system while leveraging existing authorizations?

Accepted Answer

Inheritance and leveraging

Answer

Inheritance and leveraging allows agencies and CSPs to reuse security controls already authorized in underlying FedRAMP services, reducing duplicated assessment effort.

Question 5

Which phase of the RMF involves ongoing activities like vulnerability scanning, log review, and security status reporting after an ATO is granted?

Accepted Answer

Monitor

Answer

The Monitor phase (step 6 of the RMF) encompasses continuous monitoring activities to ensure the security posture remains acceptable throughout the system's operational life.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Risk Management Framework & Assessment 3