FedRAMP Security Controls Implementation & NIST SP 800-53 2

Question 1

Which NIST SP 800-53 control family is responsible for configuration management requirements?

Accepted Answer

CM - Configuration Management

Answer

SI - System and Information Integrity

Answer

SA - System and Services Acquisition

Answer

MP - Media Protection

Question 2

What is a 'compensating control' in the context of FedRAMP?

Accepted Answer

An alternative control implemented when the required control cannot be met

Answer

An additional control added beyond the baseline requirements

Answer

A control specifically for compensating contractors

Answer

A financial control for managing cloud service costs

Question 3

In FedRAMP, what is the purpose of the 'Inherited' control designation in the SSP?

Accepted Answer

Controls fully implemented by the underlying infrastructure provider that the CSP can inherit

Answer

Controls that are inherited from NIST guidance and require no implementation

Answer

Controls passed down from previous ATO holders

Answer

Controls that apply only to legacy systems

Question 4

Which control in NIST SP 800-53 specifically requires multi-factor authentication for privileged accounts?

Accepted Answer

IA-2: Identification and Authentication

Answer

AC-2: Account Management

Answer

AC-17: Remote Access

Answer

IA-5: Authenticator Management

Question 5

What does FIPS 140-2 or 140-3 validation requirement mean for FedRAMP cloud systems?

Accepted Answer

All data must be encrypted using validated cryptographic modules

Answer

All staff must pass a FIPS background investigation

Answer

Systems must use only FIPS-approved operating systems

Answer

Annual FIPS compliance audits are required

Question 6

Which NIST SP 800-53 control family addresses personnel security, including background investigations?

Accepted Answer

PS - Personnel Security

Answer

AT - Awareness and Training

Answer

PE - Physical and Environmental Protection

Answer

PL - Planning

Question 7

What is the significance of the 'Shared' responsibility designation for a FedRAMP control?

Accepted Answer

Both the CSP and the federal agency share implementation responsibility

Answer

The control is shared across multiple cloud regions

Answer

Multiple 3PAOs must assess the control jointly

Answer

The control cost is split between CSP and government