FedRAMP Security Authorization & Compliance 4

Question 1

An agency AO reviews a CSP's authorization package and decides the residual risk is acceptable. What document does the AO issue?

Accepted Answer

Authority to Operate (ATO) letter

Answer

After reviewing the authorization package and accepting residual risk, the AO issues an Authority to Operate (ATO) letter.

Question 2

Which FedRAMP document establishes the scope of what is being assessed, including system boundaries and external connections?

Accepted Answer

System Security Plan (SSP)

Answer

The SSP defines the authorization boundary, describes interconnections, and scopes what controls apply to the system.

Question 3

FedRAMP requires CSPs to use a FIPS 140-2 validated cryptographic module. What does FIPS 140-2 validate?

Accepted Answer

Cryptographic module security

Answer

FIPS 140-2 is the federal standard for validating the security of cryptographic modules used to protect sensitive data.

Question 4

Under FedRAMP's shared responsibility model, which controls are typically the customer agency's responsibility in a SaaS deployment?

Accepted Answer

User access provisioning and data classification

Answer

In a SaaS model, the agency typically owns controls like user account management and data classification, while the CSP owns the infrastructure.

Question 5

What is the maximum validity period for a FedRAMP Agency ATO before it must be formally renewed or re-assessed?

Accepted Answer

3 years

Answer

FedRAMP ATOs are valid for three years, after which the authorization must be reviewed and renewed.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test