FedRAMP Security Controls Implementation & NIST SP 800-53

Question 1

Which NIST publication defines the security and privacy controls baseline that FedRAMP requires CSPs to implement?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-37

Answer

NIST SP 800-171

Answer

NIST SP 800-30

Question 2

FedRAMP defines three impact levels for cloud systems. Which set correctly represents all three?

Accepted Answer

Low, Moderate, High

Answer

Basic, Standard, Enhanced

Answer

Level 1, Level 2, Level 3

Answer

Minimal, Moderate, Critical

Question 3

How many security controls are required at the FedRAMP Moderate baseline?

Accepted Answer

Approximately 325

Answer

Approximately 125

Answer

Approximately 175

Answer

Approximately 421

Question 4

In NIST SP 800-53, which control family addresses audit and accountability requirements?

Accepted Answer

AU - Audit and Accountability

Answer

AC - Access Control

Answer

AT - Awareness and Training

Answer

CA - Security Assessment and Authorization

Question 5

What does a 'control enhancement' in NIST SP 800-53 represent?

Accepted Answer

Additional functionality that builds on the base control's requirements

Answer

A completely separate control added to the baseline

Answer

An optional guideline that replaces the base control

Answer

A waiver mechanism for non-applicable controls

Question 6

Which control family in NIST SP 800-53 covers System and Communications Protection (SC)?

Accepted Answer

Controls for protecting data in transit and network boundaries

Answer

Controls for physical access to server rooms

Answer

Controls for background checks on personnel

Answer

Controls for software development lifecycle

Question 7

What is the primary purpose of the FedRAMP parameter table in the System Security Plan?

Accepted Answer

To document organization-defined values for controls with variable parameters

Answer

To list all CSP employees with security responsibilities

Answer

To track penetration testing schedules

Answer

To catalog all third-party software licenses