FedRAMP Security Authorization & Compliance 5

Question 1

What is the purpose of the FedRAMP 'ConMon' monthly deliverables submitted by a CSP?

Accepted Answer

To provide ongoing evidence that security controls remain effective

Answer

Monthly ConMon deliverables (scan results, POA&M updates) demonstrate that the authorized system continues to meet security requirements.

Question 2

An agency is evaluating a CSP listed as 'FedRAMP Authorized' on the Marketplace. Which document should the agency request to understand implemented controls?

Accepted Answer

The full authorization package including SSP, SAR, and POA&M

Answer

Agencies should request the full authorization package—SSP, SAR, and POA&M—to fully understand the control implementation and residual risks.

Question 3

Under FedRAMP, what action is required when a CSP wants to add a new external service or API integration that was not in the original authorization boundary?

Accepted Answer

Submit a significant change request and update the SSP and authorization boundary

Answer

Adding external integrations that affect the boundary requires a significant change request, SSP update, and AO review.

Question 4

Which of the following best describes the role of a 3PAO in the FedRAMP authorization process?

Accepted Answer

They independently assess the CSP's security controls and produce the SAR

Answer

A Third Party Assessment Organization (3PAO) independently evaluates the CSP's controls and documents findings in the Security Assessment Report.

Question 5

What does FedRAMP require for systems handling Controlled Unclassified Information (CUI) at the Moderate impact level?

Accepted Answer

FedRAMP Moderate baseline controls must be implemented

Answer

Systems handling CUI at Moderate impact must implement FedRAMP Moderate baseline controls (~325 controls).

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Security Authorization & Compliance 5