FedRAMP Security Controls Implementation & NIST SP 800-53

Question 1

Which NIST publication defines the security and privacy controls baseline that FedRAMP requires CSPs to implement?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides the catalog of security and privacy controls that forms the foundation of FedRAMP control baselines.

Question 2

FedRAMP defines three impact levels for cloud systems. Which set correctly represents all three?

Accepted Answer

Low, Moderate, High

Answer

FedRAMP uses Low, Moderate, and High impact levels based on the potential impact of a security breach on federal operations.

Question 3

How many security controls are required at the FedRAMP Moderate baseline?

Accepted Answer

Approximately 325

Answer

The FedRAMP Moderate baseline requires approximately 325 security controls, reflecting the higher risk tolerance compared to Low but below High impact.

Question 4

In NIST SP 800-53, which control family addresses audit and accountability requirements?

Accepted Answer

AU - Audit and Accountability

Answer

AU (Audit and Accountability) is the control family in NIST SP 800-53 responsible for logging, audit record generation, and accountability controls.

Question 5

What does a 'control enhancement' in NIST SP 800-53 represent?

Accepted Answer

Additional functionality that builds on the base control's requirements

Answer

Control enhancements in NIST SP 800-53 add additional specificity, strength, or scope to a base control, increasing its effectiveness.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Security Controls Implementation & NIST SP 800-53