FedRAMP Security Controls Implementation & NIST SP 800-53 3

Question 1

Which NIST SP 800-53 control requires organizations to develop, document, and periodically update system security plans?

Accepted Answer

PL-2: System Security Plan

Answer

PL-2 (System Security Plan) requires organizations to develop and maintain an SSP covering controls implementation, environment description, and system boundaries.

Question 2

In the context of FedRAMP controls, what does 'Fully Implemented' (FI) mean in the control summary table?

Accepted Answer

All aspects of the control are operational and meet FedRAMP requirements

Answer

Fully Implemented (FI) indicates that all components of the control are deployed, operational, and satisfying the stated requirements at the time of assessment.

Question 3

Which control in NIST SP 800-53 addresses vulnerability scanning requirements?

Accepted Answer

RA-5: Vulnerability Monitoring and Scanning

Answer

RA-5 (Vulnerability Monitoring and Scanning) requires organizations to scan for vulnerabilities in systems and applications at defined frequencies.

Question 4

What is the minimum frequency FedRAMP Moderate baseline requires for vulnerability scanning of operating systems?

Accepted Answer

Monthly

Answer

FedRAMP requires OS/infrastructure vulnerability scanning at least monthly for Moderate impact systems as defined in RA-5 parameter requirements.

Question 5

Which NIST SP 800-53 control family covers incident response planning and execution?

Accepted Answer

IR - Incident Response

Answer

IR (Incident Response) covers the full incident response lifecycle including preparation, detection, analysis, containment, eradication, and recovery.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Security Controls Implementation & NIST SP 800-53 3