FedRAMP Continuous Monitoring & Incident Response

Question 1

What is the purpose of continuous monitoring in FedRAMP?

Accepted Answer

Ongoing security assessment

Answer

The purpose of continuous monitoring in FedRAMP is to provide an ongoing, real-time assessment of a cloud service's security posture. It moves beyond a one-time authorization by requiring regular security activities like vulnerability scanning, penetration testing, and configuration management. This ensures that the system remains secure against evolving threats and maintains its compliance throughout its operational lifecycle, rather than just at the point of initial approval.

Question 2

What is an incident response plan?

Accepted Answer

Plan to manage security incidents

Answer

An incident response plan is a critical, pre-defined set of procedures and protocols designed to guide an organization's actions when a security incident occurs. Its purpose is to enable a swift, effective, and coordinated response to security breaches, cyberattacks, or other security events. This plan helps minimize damage, restore normal operations, and facilitate learning from the incident to prevent future occurrences.

Question 3

Why is timely incident detection critical?

Accepted Answer

Minimizes damage and speeds recovery

Answer

Timely incident detection is critical because the faster a security incident is identified, the sooner an organization can initiate its response. Rapid detection allows for quicker containment of the threat, limiting the scope of damage, data loss, or system compromise. This ultimately minimizes the overall impact and cost of the incident and speeds up the recovery process, restoring normal operations more quickly.

Question 4

Who should be involved in incident response?

Accepted Answer

IT, management, and security

Answer

Effective incident response requires a multidisciplinary approach involving various stakeholders. IT staff are crucial for technical analysis and remediation, security personnel guide the overall security strategy and forensic efforts, and management provides necessary resources, makes critical decisions, and handles communication. Involving IT, management, and security ensures a comprehensive and coordinated response that addresses technical, operational, and strategic aspects of an incident.

Question 5

What is the role of logging in continuous monitoring?

Accepted Answer

Records activities for detection

Answer

Logging plays a fundamental role in continuous monitoring by systematically recording system events, user activities, and network traffic. These logs serve as an invaluable source of data for detecting anomalies, suspicious behavior, and potential security incidents. By analyzing logs, security teams can identify indicators of compromise, understand the scope of an attack, and support forensic investigations, which is crucial for maintaining security.

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

(FedRAMP) Federal Risk and Authorization Management Program Certified Practice Test

FedRAMP Continuous Monitoring & Incident Response