KBQ- FedRAMP

What is the purpose of FedRAMP?​

​

• To promote the adoption of secure cloud services across the private sector​

• To standardize the security requirements for cloud services used by federal agencies

• To manage the financial budget of cloud services​

• To enforce data privacy laws globally​

What is the designation for a Cloud Service Provider (CSP) that has successfully completed FedRAMP Authorization?​

• FedRAMP Ready​

• FedRAMP In Process​

• FedRAMP Authorized​

• FedRAMP Review​

Which of the following is NOT a benefit of FedRAMP?​

• Promotes innovation in cloud services​

• Ensures data protection in the private sector​

• Allows federal agencies to reuse security authorization packages​

• Helps federal agencies adopt cloud technologies faster​

Which organization manages the FedRAMP Marketplace?​

• Federal Communications Commission (FCC)​

• General Services Administration (GSA)​

• National Institute of Standards and Technology (NIST)​

• Federal Risk Management Office (FRMO)​

Which federal mandate requires the use of validated cryptographic modules in FedRAMP-compliant systems?​

​

• FIPS 140-2​

• NIST SP 800-53​

• Freedom of Information Act (FOIA)​

• NIST 800-137​

What is the maximum number of controls included in the High Impact Level (High Baseline) for FedRAMP?​

• 156​

• 323​

• 410​

• 500​

In which phase of the FedRAMP authorization process are security deliverables and vulnerability scans provided?​

• Authorization Phase​

• Continuous Monitoring Phase​

• Pre-Authorization Phase​

• Final Assessment Phase​

Which of the following is a component of the System Security Plan (SSP) under FedRAMP?​

• Incident Response Plan (IRP)​

• Service Level Agreement (SLA)​

• Digital Identity Level Report​

• Identification of system owners and authorizing officials​

Which body is responsible for setting security requirements for CSPs and authorizing the use of cloud services in FedRAMP?​

• FedRAMP Board​

• Federal Risk Management Office (FRMO)​

• National Institute of Standards and Technology (NIST)​

• Office of Management and Budget (OMB)​

Which of the following is required for systems with Moderate and High baseline systems in FedRAMP?​

• Systems must be tested annually by the Federal Risk Management Office (FRMO)​

• Systems must be audited monthly by a FedRAMP-authorized third party​

• Vulnerabilities must be remediated within 60 days​

• Systems must meet a set of security mandates including FIPS 140-2 validation​