FedRAMP Security Controls Implementation & NIST SP 800-53 2

Question 1

Which NIST SP 800-53 control family is responsible for configuration management requirements?

Accepted Answer

CM - Configuration Management

Answer

CM (Configuration Management) covers baseline configurations, change control, and configuration monitoring for information systems.

Question 2

What is a 'compensating control' in the context of FedRAMP?

Accepted Answer

An alternative control implemented when the required control cannot be met

Answer

A compensating control provides equivalent protection when implementing the required control is not feasible, requiring documented justification and AO approval.

Question 3

In FedRAMP, what is the purpose of the 'Inherited' control designation in the SSP?

Accepted Answer

Controls fully implemented by the underlying infrastructure provider that the CSP can inherit

Answer

Inherited controls are security controls fully implemented by an underlying provider (e.g., IaaS), allowing the CSP to inherit their implementation and documentation.

Question 4

Which control in NIST SP 800-53 specifically requires multi-factor authentication for privileged accounts?

Accepted Answer

IA-2: Identification and Authentication

Answer

IA-2 (Identification and Authentication) and its enhancements, particularly IA-2(1), require multi-factor authentication for network access to privileged accounts.

Question 5

What does FIPS 140-2 or 140-3 validation requirement mean for FedRAMP cloud systems?

Accepted Answer

All data must be encrypted using validated cryptographic modules

Answer

FedRAMP requires that cryptographic modules protecting federal data meet FIPS 140-2 or 140-3 validation, ensuring standardized and tested encryption implementations.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Security Controls Implementation & NIST SP 800-53 2