FedRAMP Risk Management Framework & Assessment 5

Question 1

A CSP implements a compensating control because the baseline control is technically infeasible. What documentation is required?

Accepted Answer

A formal deviation request or alternative implementation documented in the SSP with justification

Answer

Compensating controls and deviations must be formally documented in the SSP with a clear justification, showing how the alternative provides equivalent protection.

Question 2

Which of the following best describes the role of NIST SP 800-30 in FedRAMP risk assessments?

Accepted Answer

It provides guidance for conducting risk assessments, including threat identification and likelihood determination

Answer

NIST SP 800-30, 'Guide for Conducting Risk Assessments,' provides the methodology and process for identifying threats, vulnerabilities, and calculating risk that underpins FedRAMP risk assessments.

Question 3

An agency is using a FedRAMP Moderate authorized IaaS. They deploy a custom application that processes Controlled Unclassified Information (CUI). At what impact level must the custom application be assessed?

Accepted Answer

Moderate, matching the underlying IaaS authorization level

Answer

The agency's application must be assessed at Moderate or higher based on FIPS 199 categorization of the CUI it handles; it can leverage the IaaS Moderate controls but must still be assessed itself.

Question 4

What is the significance of the 'impact level' assignment in FedRAMP relative to selecting a security control baseline?

Accepted Answer

It directly determines which FedRAMP control baseline (Low, Moderate, or High) must be implemented

Answer

The FIPS 199 impact level (Low, Moderate, or High) maps directly to the corresponding FedRAMP security control baseline that the CSP must implement and the 3PAO must assess.

Question 5

Under FedRAMP continuous monitoring requirements, how frequently must CSPs provide vulnerability scan results to the FedRAMP PMO and authorizing agencies?

Accepted Answer

Monthly

Answer

FedRAMP requires CSPs to submit vulnerability scan results on a monthly basis as part of their continuous monitoring deliverables.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Risk Management Framework & Assessment 5