FedRAMP Security Authorization & Compliance 3

Question 1

Which NIST publication provides the control families that FedRAMP baselines are derived from?

Accepted Answer

NIST SP 800-53

Answer

FedRAMP control baselines are built upon the security and privacy controls defined in NIST SP 800-53.

Question 2

A federal agency wants to use a FedRAMP-authorized SaaS product. What document must the agency issue before using the service?

Accepted Answer

An Agency Authorization to Operate (ATO)

Answer

Each federal agency must issue its own Agency ATO, leveraging the existing FedRAMP authorization package, before using the service.

Question 3

What is the FedRAMP continuous monitoring frequency requirement for vulnerability scanning of operating systems?

Accepted Answer

Monthly

Answer

FedRAMP requires OS vulnerability scans to be performed at least monthly as part of continuous monitoring.

Question 4

Under FedRAMP, which party is responsible for ensuring that underlying infrastructure controls are implemented in a CSP's IaaS environment?

Accepted Answer

The IaaS provider (as inherited controls)

Answer

In an IaaS model, the underlying infrastructure controls are inherited from the IaaS provider, who is responsible for their implementation.

Question 5

A CSP discovers a new critical vulnerability in its authorized system. Under FedRAMP ConMon, what is the FIRST required action?

Accepted Answer

Report the vulnerability in the POA&M within the required timeframe

Answer

FedRAMP requires CSPs to document discovered vulnerabilities in the POA&M within the specified reporting timeframe.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test