FedRAMP Risk Management Framework & Assessment 4

Question 1

A CSP uses a subcontractor to provide physical data center services. Under FedRAMP, how must this relationship be handled?

Accepted Answer

The subcontractor's services must be included in the CSP's authorization boundary or separately authorized

Answer

External services that process, store, or transmit federal data must either be within the CSP's authorization boundary or hold their own FedRAMP authorization that can be leveraged.

Question 2

Which FIPS publication establishes the standards for categorizing federal information and information systems?

Accepted Answer

FIPS 199

Answer

FIPS 199, 'Standards for Security Categorization of Federal Information and Information Systems,' defines the Low, Moderate, and High impact categories used in FedRAMP.

Question 3

What is the primary difference between a FedRAMP Provisional ATO (P-ATO) and an Agency ATO?

Accepted Answer

A P-ATO is issued by the JAB and is reusable by any agency; an Agency ATO is issued by a single sponsoring agency

Answer

A JAB P-ATO is issued by the Joint Authorization Board and signals government-wide acceptance, allowing multiple agencies to reuse it; an Agency ATO is granted by a single agency's Authorizing Official.

Question 4

During risk assessment, what does 'likelihood' refer to in the context of threat analysis?

Accepted Answer

The probability that a threat source will exploit a given vulnerability

Answer

Likelihood is the probability or chance that a threat actor will successfully exploit a vulnerability, considering factors such as threat motivation, capability, and existing controls.

Question 5

A federal agency's Authorizing Official (AO) reviews a FedRAMP package and decides to accept the risk and grant an ATO. Who is ultimately accountable for that risk acceptance decision?

Accepted Answer

The Authorizing Official (AO)

Answer

The Authorizing Official bears personal accountability for the risk acceptance decision and is responsible for the security posture of the system they authorize.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Risk Management Framework & Assessment 4