FedRAMP Security Authorization & Compliance 2

Question 1

Which FedRAMP document formally records the agreed-upon security controls and their implementation status for a cloud system?

Accepted Answer

System Security Plan (SSP)

Answer

The System Security Plan (SSP) is the primary document that describes how a cloud system implements its required security controls.

Question 2

Under FedRAMP, what is the maximum time allowed to remediate a High-impact finding discovered during continuous monitoring?

Accepted Answer

30 days

Answer

FedRAMP requires that High-impact vulnerabilities be remediated within 30 days of discovery.

Question 3

Which entity is responsible for maintaining the FedRAMP Marketplace and publishing authorization statuses for CSPs?

Accepted Answer

The Program Management Office (PMO)

Answer

The FedRAMP Program Management Office (PMO) maintains the FedRAMP Marketplace listing all authorized cloud services.

Question 4

A CSP's cloud offering is granted a P-ATO. What does this mean for other federal agencies?

Accepted Answer

They can issue their own ATO leveraging the P-ATO without a full reassessment

Answer

A Provisional ATO (P-ATO) from the JAB allows other agencies to issue their own ATO by reusing the existing assessment package.

Question 5

Which FedRAMP baseline applies to cloud systems processing data where loss of confidentiality, integrity, or availability would have a limited adverse effect?

Accepted Answer

FedRAMP Low

Answer

FedRAMP Low baseline applies to systems where a security breach would have limited adverse effects on operations or individuals.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Security Authorization & Compliance 2