CMMC-CCA Certified CMMC Assessor (CCA) Exam Free Dumps

1. A Defense Contractor is a CMMC Level 2 organization that frequently needs to transport digital media containing CUI between their main office and an off-site data storage facility. In preparing for their upcoming CMMC assessment, the organization's OSC has closely reviewed the requirements of CMMC practice MP.L2-3.8.6-Portable Storage Encryption, which specifically addresses the protection of CUI stored on digital devices during transport. The OSC recognizes their current practices of simply placing the media in standard packaging and using commercial shipping services do not fully meet the control's mandatory requirements.

Under CMMC practice MP.L2-3.8.6-Portable Storage Encryption, what is the mandatory requirement to protect CUI stored on digital devices during transport?

2. The CMMC Assessment Process (CAP) requires the Lead Assessor to validate the CMMC Assessment Scope proposed by the OSC.

What is the main task the Lead Assessor must conduct in validating the CMMC Assessment Scope? Choose the option that best describes the validation.

3. During the planning and preparation discussions, a key member of the C3PAO Assessment team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team.

Can the Lead Assessor proceed with the assessment using a reduced assessment team size?

4. You are the Lead Assessor on a CMMC Assessment Team preparing for an upcoming assessment. You have received the final assessment scope and supporting documentation from the OSC.

What should you do next to ensure the assessment can proceed as planned?

5. During an assessment, it was uncovered that a CCA worked as a consultant for the OSC through their RPO. Unfortunately, the CCA didn’t disclose this when their C3PAO appointed them to participate in the assessment.

Did the CCA behave professionally? If not, what issues are likely to arise?

6. A mid-sized company specializing in machining is preparing to bid for an upcoming DoD contract to provide machined components crucial for defense systems. As CMMC compliance will be required, the company’s top executives have invited you to assess their implementation of CMMC Level 2 requirements. During your visit to their environment of operations, you discover its production floor has several Computer Numerical Control (CNC) machines for precision machining, all connected to a local network for data transfer and control.

The CNC machines receive design files from a central server in the company's data center and communicate with a SCADA quality control system that monitors production metrics and performance. The central server hosts the design files, which are only accessible to authorized engineers and operators and backed up in an Amazon EBS cloud instance to ensure availability across the company's multiple machining shops in different states. Furthermore, the company allows employees to upload designs to the server remotely using VPNs and virtual desktop instances.

What is the BEST physical control the company can use for preventive purposes?

7. As a Certified CMMC Assessor, you are part of a team assessing a small defense contractor. During the assessment, an employee being interviewed appears unsure about some security practices and asks for your advice on how to answer certain questions to make their compliance appear better.

As a Certified CMMC assessor, what should you do in this situation?

8. A software development company is applying for a CMMC Level 2 assessment. As the Lead Assessor, you request access to the company’s System Security Plan (SSP) as part of the initial objective evidence for validating the scope.

Which of the following is true about the software development company's obligations in honoring the request?

9. While examining an OSC's system design documentation, you notice they have implemented a CUI enclave and have a documented procedure addressing boundary protection. They have segmented their network into different zones, each having its own rules to allow or deny traffic. The OSC has implemented strict firewall rules that deny all incoming and outgoing traffic by default, only allowing specific traffic as required. The OSC has provisioned a state-of-the-art Intrusion Detection and Prevention System (IDPS) to block unrecognized traffic patterns automatically. During an interview with the network administrator, you realize that OSC uses a whitelisting approach to explicitly allow only certain IP addresses, domains, or services to communicate with their system. Their IT security team monitors network traffic to detect any unauthorized attempts to connect or communicate with their system. The scenario states that network traffic is monitored to detect unauthorized connection attempts.

Which of the following best describes the purpose of monitoring network traffic in the context of CMMC practice SC.L2-3.13.6-Network Communication by Exception?

10. You are evaluating an OSC for compliance with CMMC Level 2 practices. During your assessment of SC controls, you use a series of assessment methods to understand how effectively the OSC has implemented them. The OSC has a documented security policy outlining user roles and responsibilities. The OSC's system and communications protection policy states that basic user and privileged functionalities are separated. They have deployed Azure AD to help enforce this requirement through identity management.

Interviews with system administrators reveal they have elevated privileges for system management tasks. A review of system configuration settings shows separate user accounts for standard users and administrators. However, you notice that some employees use personal cloud storage services for storing work documents.

Based on CMMC practice SC.L2-3.13.3-Role Separation, which of the following findings from the scenario is MOST concerning?

11. Understanding that changes are critical in any production environment, a DoD contractor has instituted measures to manage them. All software changes can only be implemented by defined individuals. These changes must go through a rigorous change approval process and must be implemented from a secure server located in the company's headquarters.

The personnel affecting the changes access the server room using access cards and an iris scan. To log into the server, they must enter their passwords to receive a one-time password (OTP), which must be keyed in within 2 minutes. After any changes are made, the chairperson of the contractor's Change Review Board and the CISO get a notification to approve the changes before they take effect.

To demonstrate their compliance with CM.L2-3.4.5-Access Restrictions for Change, what can the contractor NOT cite as evidence?

12. You are assessing an OSC that utilizes containerization technology for deploying microservices within a Kubernetes cluster. These microservices leverage various JavaScript frameworks for functionality. While a mobile device management (MDM) solution secures company phones, access to these microservices is primarily through web interfaces.

Which security tool would be most beneficial to use for effectively monitoring mobile code usage within the described scenario (SC.L2-3.13.13-Mobile Code)?

13. A Defense Contractor is preparing for their upcoming CMMC Level 2 assessment. One of the key controls they need to address is CMMC practice MP.L2-3.8.5-Media Accountability, which deals with maintaining accountability for media containing CUI during transport outside controlled areas. The organization regularly needs to transport physical media, such as hard drives and backup tapes, between its primary data center and an off-site storage facility. In the past, they have simply used standard packaging and commercial shipping services to move this media.

Which of the following is NOT an assessment method for MP.L2-3.8.5-Media Accountability?

14. When interviewing a contractor’s CISO, they inform you that they have documented procedures addressing security assessment planning in their security assessment and authorization policy. The policy indicates the contractor undergoes regular security audits and penetration testing to assess the posture of its security controls every ten months. The policy also states that the contractor tests its incident response plan every four months and regularly updates its monitoring tools. Impressed by the contractor's policy implementation, you decide to chat with various personnel involved in security functionalities. You realize that although it is documented in the policy, the contractor has not audited its security systems in over two years.

Which of the following must be considered for the contractor's implementation of CA.L2-3.12.1-Security Control Assessment to be successful?

15. A CCA has been selected to lead a team conducting a CMMC assessment for an OSC. However, it is later determined that the OSC's Point Of Contact (POC) is the CCA’s sibling.

Could this situation present a potential Conflict of Interest (COI)?

If so, which guiding principle or practice of the CoPC (Code of Professional Conduct) might the CCA have violated?

16. Members of the CMMC ecosystem must meet the CoPC's expectations. However, certain factors might trigger a Cyber AB investigation of a credentialed individual or organization.

Which of the following can trigger an investigation by the Cyber AB? The Cyber AB receives information relating to a violation of the CoPC

17. A contractor allows for the use of mobile devices in contract performance. Some employees access designs and specifications classified as CUI on devices like tablets and smartphones. After assessing AC.L2-3.1.18-Mobile Device Connection, you find the contractor maintains a meticulous record of mobile devices that connect to its information systems. AC.L2.3.1.19-Encrypt CUI on Mobile, requires the contractor to implement measures to encrypt CUI on mobile devices and mobile computing platforms. The contractor uses device-based encryption where all data on a mobile device is encrypted.

Which of the following personnel should you interview to determine how well the contractor has implemented AC.L2-3.1.19-Encrypt CUI on Mobile?

18. When discussing the OSC's proposed assessment scope, the lead assessor learned that some laptops and workstations share a network with CUI assets, but their users do not work with CUI. These assets do not store CUI or run applications that process CUI. Reviewing the OSC's SSP, the implemented risk-based security policies, procedures, and practices raised questions and were found to be deficient.

What can the Lead Assessor do in this scenario?

19. You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery.

What would you recommend the contractor do to avert the risk?

20. Jane is a CCA leading a CMMC assessment for an OSC. During the evaluation, Jane discovers the OSC's Chief Information Security Officer (CISO) is a former colleague with whom she had a contentious relationship. Unbeknownst to the OSC, Jane still harbors resentment towards the CISO due to their previous conflicts. As the assessment progresses, Jane becomes increasingly critical of the CISO's security practices, scrutinizing every detail and finding fault despite the OSC's best efforts to demonstrate compliance.

Given this scenario, how can a Certified CMMC Assessor's personal bias impact the assessment of the OSC?

21. You are a CCA with an active and good standing on the Cyber AB Marketplace. An OSC has contracted your C3PAO for a prospective CMMC Assessment. The OSC provides signal processing services for the DoD. You assisted the OSC in preparing for the upcoming CMMC assessment by conducting an initial evaluation of their implementation practices. With your background in cybersecurity and extensive experience, your C3PAO and Lead Assessor have selected you to join the Assessment Team.

Based on this scenario, which of the following is the most important factor for the C3PAO to consider when assigning assessors to the Assessment Team?

22. Proper authentication is a key requirement of a secure system. To this end, you are assessing an OSC's implementation of IA.L2-3.5.3-Multifactor Authentication. The contractor has deployed Okta in their systems, integrated it into Active Directory (AD), and set up multifactor authentication (MFA). The OSC has documented all the privileged accounts, which must be authenticated through the MFA solution for any network or local access. Their procedures addressing user identification and authentication require everyone, privileged and nonprivileged, to be authenticated using multifactor authentication.

The OSC (Organization Seeking Certification) can produce the following evidence to show their compliance with IA.L2-3.5.3-Multifactor Authentication, EXCEPT?

Which evidence can the OSC (Organization Seeking Certification) NOT use as evidence to show their compliance with IA.L2-3.5.3-Multifactor Authentication?

23. You are a CCA working for a C3PAO. An OSC has submitted a request for a CMMC Assessment, and the C3PAO is in the process of assigning a Lead Assessor for this engagement. As an experienced Assessor, you are being considered for the role of Lead Assessor.

Which of the following factors should the C3PAO NOT consider when selecting a Lead Assessor for this assessment?

24. You are a CCA working for a well-known C3PAO. You have been selected for an Assessment Team tasked with conducting a CMMC assessment on a C3PAO. While you are reviewing the presented evidence, one of the Assessment Team members informs you that they weren’t trained for the job and that a friend helped them get the position.

By employing non-credentialed individuals and assigning them assessment tasks, which requirement of the CoPC has the C3PAO violated?

25. After a security audit, a contractor documents specific vulnerabilities and deficiencies in an audit report. After examining its POA&M, you realize it has a clearly defined policy on addressing these deficiencies and by when. However, after interviewing the contractor’s security and compliance team, you learn that while an audit is regularly conducted, the remediation measures are not always taken, and when taken, they are not always practical. The security and compliance team informs you they have tried reaching the system administrator to explain the repercussions of this without success.

Based on the scenario, how would you rate the contractor's implementation of CA.L2-3.12.2-Plan of Action?

26. During a CMMC assessment for an OSC, the CCA needs to assess their implementation of CMMC practice MP.L2-3.8.4-Media Markings, which requires proper marking and labeling of CUI. The interview with the information security personnel reveals a well-defined policy, but you need concrete evidence to verify its effectiveness.

Which of the following would provide sufficient evidence to assess a contractor's implementation of CMMC practice MP.L2-3.8.4-Media Markings?

27. John, a Certified CMMC Assessor, has been conducting CMMC assessments for several years. During a recent assessment at a defense contractor, he encountered several issues similar to challenges he had faced in previous assessments. John's interpretation of the contractor's practices was influenced by his past experiences.

Which of the following is TRUE about John's interpretation?

28. A remote access session must be secured using FIPS-validated cryptography to provide confidentiality and prevent anyone from deciphering session information.

To demonstrate compliance with AC.L2-3.1.13-Remote Access Confidentiality, what can't the contractor provide as evidence?

29. Change is a part of any production process and must be meticulously managed. System Change Management is a CMMC requirement, and you have been called in to assess the implementation of CMMC requirements. When examining the contractor’s change management policy, you realize there is a defined change advisory board that has a review and approval mandate for any proposed changes. The change advisory board maintains a change request system where all the changes are submitted and documented for easy tracking and review. The contractor also has a defined rollback plan defining what to do if the approved changes result in unexpected issues or vulnerabilities.

What evidence artifacts can the contractor also cite as evidence to show their compliance with CM.L2-3.4.3-System Change Management besides their compliance management policy?

30. As a Lead Assessor working with an OSC in preparation for an upcoming assessment, you request they appoint an Assessment Official. This is the individual you will be collaborating with and has the OSC's decision-making authority regarding the CMMC Assessment. The OSC Assessment Official will lead and manage the OSC's engagement in the assessment.

As the Lead Assessor, which of the following responsibilities would you expect the OSC Assessment Official NOT to have?

31. You have been hired to assess a contractor's implementation of remote access capabilities for information systems that handle CUI. While interviewing the network administrator, you realize they perform privileged activities remotely when at alternate worksites.

In addition to identifying authorized privileged commands and security-relevant information, which of the following measures MUST the contractor consider to ensure compliance with CMMC practice AC.L2-3.1.15-Privileged Remote Access?

32. A software development company wins a DoD contract requiring CMMC Level 2. The company is small and has one main office. However, it outsources some data storage requirements to a cloud service provider (CSP).

What type of organization would the cloud service provider be considered in the CMMC assessment scope?

33. A C3PAO and OSC have agreed to proceed with CMMC assessment planning. The OSC assessment official and the C3PAO are working to determine the planning details and purview of the Assessment, which includes scoping.

Who is responsible for initially determining the CMMC Assessment Scope?

34. A contractor has recently allowed its employees to work remotely. The employees can access CUI remotely through VPN with encrypted tunnels for remote access into their VDIs. The company has a variety of system components (servers, workstations, notebook computers, smartphones, and tablets)

that employees can access remotely. In your assessment, you also realize that some employees are using SSH to access information stored in cloud instances and server infrastructures that contain CUI.

Which of the following would be the MOST effective way to ensure that only authorized users and devices are connecting to the remote access system?

35. During your assessment of CA.L2-3.12.3-Security Control Monitoring, the contractor's CISO informs you that they have established a continuous monitoring program to assess the effectiveness of their implemented security controls. When examining their security planning policy, you determine they have a list of automated tools they use to track and report weekly changes in the security controls.

The contractor has also established a feedback mechanism that helps them identify areas of improvement in their security controls. Chatting with employees, you understand the contractor regularly invites resource persons to train them on the secure handling of information and identifying gaps in security controls implemented.

Can the contractor place practice CA.L2-3.12.3-Security Control Monitoring under a POA&M if unimplemented or not fully met?

36. You were the Lead Assessor on a team that conducted a CMMC assessment for an OSC that passed and earned a CMMC L2 Certification. After meeting this requirement, the OSC bid on and won a DoD contract. However, a rival company disputes the OSC's CMMC certification status in court. As part of the evidence, the court has directed you to release the assessment results and any evidence you might have relied on to arrive at the assessment results.

Based on the CoPC, what action should you take in this situation?

37. Documentation is a key aspect of the CMMC assessment. When preparing for a prospective assessment and during the actual CMMC assessment, you will reference various documents and document various findings. Fortunately, you can download some of these documents from the DoD CIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC's preparedness and readiness for a CMMC assessment.

Where would you document the OSC's readiness to proceed to the second phase of the CMMC Assessment Process (CAP)?

38. You decide to interview the IT security team to understand if and how a contractor has implemented audit failure alerting. You learn they have deployed AlienVault OSSIM, a feature-rich security information and event management (SIEM) tool. The SIEM tool has been configured to automatically alert system and network administrators if an event affects the audit logging process. Alerts are generated for the defined events that lead to failure in audit logging and can be found in the notification section of the SIEM portal. However, the alerts are sent to the specified personnel 24 hours after the occurrence of an event.

For the implementation of CMMC practices, how would you score AU.L2-3.3.4-Audit Failure Alerting?

39. After completing a CMMC assessment, the OSC should hash all the evidence artifacts according to the CMMC Artifact Hashing Tool User Guide. However, you have just realized that this requirement was not fulfilled, and the OSC Assessment Official cannot be reached to confirm it was done. To avoid any issues, you quickly complete this step and later inform the OSC Assessment Official.

Which CoPC principle have you just violated by hashing the evidence artifacts in place of the OSC?

40. You are the Lead Assessor for a CMMC Assessment engagement with OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts.

If the OSC shares proprietary information with the Lead Assessor during the assessment engagement, what is the C3PAO's responsibility regarding this information after the completion of the assessment?

41. To transfer CUI between a government client and its internal systems, a defense contractor uses a Secure File-Sharing Application provided by the DoD. However, all the data traversing this boundary MUST pass through a next generation firewall (NGFW) managed by the contractor's Network Admin. All CUI is stored on a Solid State Drive (SSD) and accessed through a laptop.

What type of asset is the Network Admin?

42. During a CMMC assessment, the Lead Assessor, Emily, notices one of the CCAs on her team, Alex, seems overly critical and skeptical of the evidence presented by the OSC. Although the OSC demonstrates compliance with the required CMMC practices, Alex repeatedly questions the validity of the evidence and suggests the OSC is not meeting the criteria.

Concerned that Alex's behavior may be influenced by bias, Emily decides to address the issue directly. She recalls a previous incident in which Alex took a similar approach to evaluating practices and evidence, and shortly afterward, the OSC experienced a data breach.

What steps should Emily and, most importantly, the C3PAO have taken to prevent this eventuality?

43. While reviewing an OSC's system security control, you focus on CMMC practice SC.L2-3.13.9-Connections Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network.

The server operating system utilizes default settings for connection timeouts. Network security is managed through a central firewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, no documented policy or procedure outlines a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work. The scenario mentions that the server utilizes default settings for connection timeouts.

Besides relying solely on user awareness, what additional approach could be implemented to achieve connection termination based on inactivity and comply with CMMC practice SC.L2-3.13.9-Connections Termination?

44. Jane is a CCA for a leading C3PAO. She is selected to be part of a team of four, headed by James, to assess how Micron Inc., an OSC, has implemented the requirements for a CMMC Level 2 certification.

However, she witnesses James striking a deal with Micron’s CISO to manipulate some findings to ensure the OSC is certified.

What should Jane do?

45. An OSC specializing in developing directed energy systems plans to bid on a DoD contract to produce a 250kW High Energy Laser Weapon System (HELWS). This system is to be deployed on military bases across the globe to protect U.S. service personnel against aerial threats, including mortars, rockets, and unmanned aerial vehicles (UAVs), including swarms of mini-UAVs. Because of the sensitivity of the information, the OSC has prohibited using emails to transmit information regarding the project, whether encrypted or otherwise. They also have instituted procedures to remove CUI from the email system.

What CMMC assessment requirements must the Assessment Team follow regarding the OSC's email system?

46. An OSC is about to convene an assessment kickoff meeting with the C3PAO Assessment Team. The team is considering the objectives of this meeting and whether it should include an examination of the OSC's evidence sufficiency.

What is NOT a reason for convening an assessment kickoff meeting?

47. In assessing an OSC's CUI handling practices, you learn they use an approved algorithm (AES-256) to encrypt the data to ensure its confidentiality. However, the encryption module they are using has not been validated under the FIPS 140 standard. The OSC believes using an approved algorithm is sufficient to comply with the CMMC practice for CUI encryption requirements.

Where can you find information about a cryptographic module's current status with FIPS?

48. As a CCA, understanding the guiding principles of the CoPC can help you when you face situations in which you are asked to compromise your values and integrity.

Which of the following is NOT a guiding principle of the CoPC?

49. A CMMC Level 2 certified DoD contractor plans to use a Cloud Service Provider (CSP) to support data storage and application hosting for their business operations. The contractor is aware of the CMMC requirements and wants to ensure compliance before engaging with the cloud service provider. After discussing this with them, you learn that most of the hosted applications aren't used for any activities related to the DoD contract. However, the stored data may contain CUI.

What requirement must the CSP meet before the DoD contractor can hire them?

50. While reviewing a contractor's Microsoft Active Directory authentication policies, you observe the account lockout threshold is configured to allow 5 consecutive invalid login attempts before locking the account for 15 minutes. Additionally, the reset account lockout counter is set to 30 seconds after each unsuccessful login attempt.

What specific threat is this configuration designed to mitigate?

51. An OSC is planning a CMMC Level 2 assessment that your C3PAO will conduct. In Phase 1.6.1 -Access and Verify Evidence, as the Lead Assessor, you are verifying the existence and accessibility of the evidence provided by the OSC. While reviewing the list of evidence mapped against the CMMC practices, you discover the OSC cannot locate several critical system security policies for key IT systems supporting their DoD contracts. These missing policies are essential for demonstrating compliance with various CMMC practices related to access control, incident response, and system maintenance.

What is the primary role of the CMMC Quality Assurance Professional (CQAP) regarding the Pre-Assessment Form?

52. A mid-sized company specializing in machining is preparing to bid for an upcoming DoD contract to provide machined components crucial for defense systems. As CMMC compliance will be required, the company's top executives have invited you to assess their implementation of CMMC Level 2 requirements. During your visit to their environment of operations, you discover their production floor has several Computer Numerical Control (CNC) machines for precision machining, all of which are connected to a local network for data transfer and control. The CNC machines receive design files from a central server in the company's data center and communicate with a SCADA quality control system that monitors production metrics and performance. The central server hosts the design files, which are only accessible to authorized engineers and operators and backed up in an Amazon EBS cloud instance to ensure availability across the company's multiple machining shops in different states. Furthermore, the company allows employees to upload designs to the server remotely using VPNs and virtual desktop instances.

What type of environment is the CNC machining shop?

53. A defense contractor retains your services to assess their information systems for CMMC compliance, particularly configuration management. The contractor uses CFEngine 3 for automated configuration and maintenance of its computer systems and networks. While chatting with the network’s system admins, you realize they have deployed a modern compliance checking and monitoring tool. However, when examining their configuration management policy, you notice the contractor uses different security configurations than those recommended by product vendors. The system administrator informs you they do this to meet the minimum configuration baselines required to achieve compliance and align with organizational policy.

When examining the contractor's security configuration checklists, which of the following parameters are you NOT likely to find?

54. You are working as a CCA on a Level 2 Assessment for a DoD prime contractor. The OSC seeks to keep assessment costs down, and the C3PAO and OSC have decided to conduct all possible work remotely. You are assigned to work primarily on the Media Protection (MP), Personnel Security (PS), and Physical Protection (PE) domains. In addition, the Lead Assessor has designated you as the one person from the Assessment Team to conduct all the on-premises work.

Which of the following factors do you and the Assessment Team NOT need to consider as part of your on-site work?

55. Pre-assessment planning is integral to the CMMC Assessment Process (CAP). You are part of a team conducting pre-assessment planning for an OSC.

Completing a pre-assessment plan is an integral part of the CAP and includes doing all the following, EXCEPT what?

56. When examining procedures addressing system security plan development and implementation, you realize the contractor has developed an SSP that defines and documents system boundaries. The SSP also contains the non-applicable security requirements approved by designated authorities. It also outlines other essential aspects, such as relationships with or connections to other systems, how security requirements will be implemented, etc. Upon interviewing personnel with information security responsibilities, you realize the contractor has not reviewed or updated the SSP and has no defined timelines.

What are the deficiencies within the contractor's system security plan from the scenario above? Choose all that apply.

57. You are assessing a contractor that develops software for air traffic control (ATC) systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery.

What risks does this pose related to the separation of duties?

58. You are conducting a CMMC assessment for an OSC. During the assessment, the OSC's lead security officer offers you a paid consultancy position after the assessment to help them address the identified issues.

How should you respond to this offer according to the Code of Professional Conduct?

59. In ensuring it meets its mandates to protect CUI under CMMC, a contractor has implemented a robust, dynamic session lock with pattern-hiding displays to prevent access and viewing of data. After every 5 minutes of inactivity, the current session is locked and a blank, black screen with a battery life indicator is displayed.

How is Session Lock typically initiated?

60. After the OSC and the Assessment Team scheduled the initial meeting, they agreed the initial discussions would be held in the OSC's facilities. Walking into the conference room, the Lead assessor notices multiple laptops and printers tagged "U.S. Government Owned."

How should the OSC have categorized these assets in their proposed assessment scope?

61. You are the lead CMMC assessor evaluating a defense contractor that develops advanced surveillance equipment and software for intelligence agencies. Given the sensitive nature of their work, the contractor has implemented robust insider threat monitoring.

During your assessment, you find out that the contractor's insider threat program tracks indicators like unauthorized data access attempts, unexplained wealth changes, workplace disputes, and disruptive behavior changes. The contractor also has regular security awareness training covering reporting potential insider threats via an anonymous hotline and web portal. High-risk roles like developers with classified codebase access receive additional insider threat vector training and are closely monitored. To verify all this, you interview the CISO, who confirms their implementation of CMMC practice AT.L2-3.2.3-Insider Threat Awareness.

How would you score the contractor's implementation of CMMC practice AT-L2-3.2.3-Insider Threat Awareness based on your evaluation?

62. During a CMMC Level 2 assessment, a CCA will evaluate whether the organization meets the requirement to "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI." According to the CMMC requirement, the CCA must determine whether FIPS-validated cryptography is employed to protect the confidentiality of CUI.

Which assessment procedure would the CCA most likely use to evaluate this requirement?

63. You are assessing an OSC that uses various collaborative computing devices, such as video conferencing systems, networked whiteboards, and webcams, for remote meetings and presentations. During your assessment, you examine the OSC's collaborative device inventory and find they have identified and documented all collaborative computing devices. Most of the identified devices have indicators (e.g., LED lights) that notify users when the devices are in use.

The OSC has also implemented a policy prohibiting the remote activation of collaborative computing devices without user consent. However, you find that the web cameras can be activated remotely by authorized IT personnel for troubleshooting purposes.

Which of the following would be the most appropriate next step for the assessor to validate the organization's compliance with the practice?

64. During your assessment of an OSC's implementation of security engineering principles throughout its system and software development lifecycles, you review their policies and interview personnel. The OSC has a documented security architecture that includes high-level security requirements such as data encryption, least privilege access controls, and input validation. However, this guidance remains fairly general.

You then examine the system design documentation for a key application processing CUI. Although security requirements are mentioned, there is no evidence that specific security engineering techniques such as threat modeling, layered protections, or secure design patterns were employed during the design phase. Interviews with the development team reveal limited experience with advanced security engineering practices beyond basic secure coding. The team admits they did not perform activities like misuse case analysis, abuse case modeling, or attack surface reviews during the design process.

In further testing, you find the OSC has established secure coding standards, conducts static code analysis, and performs penetration testing before production releases. However, there are no documented processes for incorporating explicit security engineering activities during the design and architecture phases.

For an OSC's legacy applications, what does CMMC practice SC.L2-3.13.2-Security Engineering require regarding the application of security engineering principles?

65. Any user that accesses CUI on system media should be authorized and have a lawful business purpose. While assessing a contractor’s implementation of MP.L2-3.8.2-Media Access, you examine the CUI access logs and the role of employees. Something catches your eye when an ID of an employee listed as terminated regularly accesses CUI remotely. Walking into the contractor's facilities, you observe the janitor cleaning an office where documents marked CUI are visible on the table. When you interviewed the organization's data custodian, they informed you that a media storage procedure is augmented by a physical protection and access control policy.

What would you conclude based on the collected and observed evidence?

66. You have been hired to assess an OSC's implementation of secure password storage and transmission mechanisms. The OSC uses a popular identity and access management (IAM) solution from a reputable vendor to manage user authentication across their systems. During the assessment, you examine the IAM solution's configuration and documentation, which indicate that passwords are hashed using industry-standard algorithms like SHA-256 or bcrypt before being stored in the system's database. Additionally, the IAM solution leverages TLS encryption for all communications, ensuring that passwords are transmitted securely over the network.

Which of the following measures would NOT be considered an acceptable implementation of CMMC practice IA.L2-3.5.10-Cryptographically-Protected Passwords?

67. An OSC has an established Incident Response plan and a dedicated team specifically trained to handle any potential incidents and conduct necessary analysis. When performing the assessments, you also realize the OSC has deployed IDS and SIEM tools to identify possible incidents.

Examining the contractor's incident response policy, you also learn they have defined and implemented containment strategies and have developed clear procedures for system and data recovery after an incident, including backup and restore procedures. A communication protocol is also in place to inform the affected stakeholders and users after a security incident.

Chatting with a few members of the OSC's incident response team, you learn they conduct regular drills to test and improve the effectiveness of the incident-handling capability. There are also defined and documented incident response mechanisms and a post-incident analysis procedure to identify lessons learned and make necessary improvements to the incident-handling process.

Based on the information provided, how would you assess the OSC's compliance with the IR.L2-3.6.1-Incident Handling practice?

68. An OSC employs guards to protect the manufacturing shop where the magnetic radar-absorbing coating is manufactured. This specific coating is used by the Army for a particular fleet of unmanned aerial vehicles (UAVs). The facility is under constant surveillance with the help of HD CCTVs.

Within the OSC's facilities, there is a Vector Network Analyzer (VNA) that measures the reflection and transmission properties of the coating over a range of frequencies. Guards protect the OSC's anechoic chamber, and anyone entering must use an iris scanner and sign a physical form detailing their name and reason for being there. At the door is a huge sign reading 'Authorized Personnel Only.'

Which of the following statements is true about handling the Vector Network Analyzer(VNA) in a CMMC assessment?

69. When interviewing a contractor’s CISO, they inform you they have documented procedures addressing security assessment planning in their security assessment and authorization policy. The policy indicates the contractor undergoes regular security audits and penetration testing to assess the posture of its security controls every ten months. The policy also states that every four months the contractor tests its incident response plan and regularly updates its monitoring tools.

Impressed by the contractor's policy implementation, you decide to chat with various personnel involved in security functionalities. You realize that although it is documented in the policy, the contractor has not audited their security systems in over two years.

Which action would best address the identified gap in the contractor's implementation of CA.L2.3.12.1-Security Control Assessment?

70. Examining an OSC password policy, you learn that a password should have a minimum of 15 characters. It also should have 3 uppercase letters, 2 special characters, and other alphanumeric characters. Passwords must be changed every 45 days and cannot be easily tied to the account owner. Passwords cannot be reused until 30 cycles are complete.

The OSC's systems send a temporary password to the user's email or authentication app, which is one of the events described in their password usage policy. However, a recent penetration test report shows the generated temporary passwords did not have sufficient entropy, and an attacker may guess a temporary password through brute force attacks.

How would you score the contractor's implementation of the IA domain requirement on Temporary Passwords?

71. As a Certified CMMC Assessor (CCA), you evaluate an OSC's implementation of the AC.L2-3.1.11 - Session Termination requirement during a CMMC Level 2 assessment. This requirement requires the organization to automatically terminate a user session after defined conditions are met. During your assessment, you want to determine whether the OSC has properly defined the conditions that would trigger the automatic termination of a user session, as required by assessment objective [a].

Which of the following assessment objects would you most likely examine to make this determination?

72. An OSC uses a third party in all system repairs and has hired an MSP for penetration testing. The third party comes for either adaptive, preventive, perfective, or corrective system maintenance every three months, and the penetration tester does so continuously. Whenever the third party comes for maintenance, there's no documentation of the issues they tackled. On the other hand, the penetration tester delivers meticulously detailed documentation per their contract with the OSC.

Based on this scenario, how would you score the contractor's implementation of MA.L2-3.7.1-Perform Maintenance?

73. When validating an OSC's assessment scope, an Assessment Team learns that the proposed scope is too narrow. You also determine their asset categorization is mixed up.

What should the Assessment Team do?

74. During CMMC assessment preparation, the OSC's executive team decides to hold a meeting to review the company's CMMC readiness and provide guidance. The OSC informs the CCA about this meeting, but the CCA notes this event does not require an update to the Pre-Assessment Data Form.

The Pre-Assessment Data Form should NOT be updated when which of the following occurs?

75. You are a CCA working for a C3PAO. An OSC has submitted a request for a CMMC Assessment, and the C3PAO is in the process of assigning a Lead Assessor for this engagement. As an experienced Assessor, you are being considered for the role of Lead Assessor.

Once the C3PAO assigns the Lead Assessor, what is the next step in the process?

76. An OSC is preparing for a CMMC assessment. It has multiple information systems, some of which process CUI and others that do not. The OSC has identified a specific system that processes CUI and defined this as its System Boundary. However, this system is connected to other systems within the OSC that are separately authorized and do not process CUI.

As a Certified CMMC Assessor, which of the following best describes your approach to defining the CMMC Certification Boundary and Assessment Scope for the OSC?

77. You are a CCA participating in an assessment exercise for an OSC. You have completed the exercise, and the OSC has hashed the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide.

What is the next step for your Assessment Team with respect to the Evidence Artifact Hashes?

78. After being selected for a C3PAO Assessment Team, you have been chosen as the Lead Assessor for an upcoming project involving an OSC that produces aircraft parts. Your C3PAO has assigned you various responsibilities.

Which of the following is NOT your responsibility as a Lead Assessor?

79. After the Assessment Team has been formed and the OSC Point Of Contact (POC) and assessment official have been identified, your C3PAO appoints John as the Lead Assessor. During the kickoff meeting, John reassures the OSC assessment official not to worry; they are guaranteed to pass the CMMC assessment. If they don't, John has agreed to refund 40% of the assessment fee.

Which of the following is true about John's behavior as a Certified CMMC Assessor?

80. You have been hired to assess a contractor’s implementation of remote access capabilities for information systems that handle CUI. While interviewing the network administrator, you realize they perform privileged activities remotely when at alternate worksites.

What is the primary concern about allowing remote execution of privileged commands or remote access to security-relevant information under AC.L2-3.1.15-Privileged Remote Access?

81. Angela, a CCA, is conducting a CMMC assessment for Obsidian Technologies, the OSC. During the assessment, Angela learns her spouse owns a significant amount of stock in Obsidian Technologies, and she has not disclosed this information to Obsidian Technologies or the C3PAO.

Which CMMC CoPC guiding principle has Angela violated in this scenario?

82. You are a CCA collaborating with an OSC to provide specialized consulting services. The OSC representative has inquired about strategies to validate the accuracy of their project scope. In response, you suggest leveraging a data flow diagram. This sounds interesting to the OSC. This visual representation could assist in mapping the flow of information and processes within the project, enabling a comprehensive review and verification of the scope's alignment with the client's requirements.

If you were on the Assessment Team, how would you use the data flow diagram after it is created?

83. Before an OSC categorizes its assets into different categories, it must determine the scope of applicability. However, after discussing with the OSC PoC, you learn that although they follow CUI and FCI in all forms and stages, they are mostly considered technical components.

What is the issue with the OSC's approach to determining the scope of applicability?

84. Two CCAs, John and Stella, are part of an Assessment Team conducting a CMMC assessment for an OSC, Blue Widgets Inc. During the assessment, John observes Stella interacting with key personnel from Blue Widgets Inc. He notices Stella appearing overly friendly and enthusiastic about other services their organization offers.

What should Stella have done when approached by the key personnel from the OSC about other services they offer?

85. During a CMMC Level 2 assessment, an OSC receives a Conditional Certification with several practices placed on a Plan of Action and Milestones (POA&M). After implementing corrective actions, the OSC requests the Assessment Team to conduct a POA&M Close-Out Assessment.

Which of the following is the correct action for the Team's Lead Assessor during the POA&M Close-Out Assessment?

86. You are the lead CMMC assessor evaluating a defense contractor that develops advanced surveillance equipment and software for intelligence agencies. Given the sensitive nature of their work, the contractor has implemented robust insider threat monitoring. During your assessment, you discover the contractor's insider threat program tracks indicators like unauthorized data access attempts, unexplained wealth changes, workplace disputes, and disruptive behavior changes.

The contractor also has regular security awareness training covering reporting potential insider threats via an anonymous hotline and web portal. High-risk roles like developers with classified codebase access receive additional insider threat vector training and are closely monitored. To verify all this, you interview the CISO, who confirms their implementation of CMMC practice AT.L2-3.2.3-Insider Threat Awareness. The contractor uses an anonymous hotline and web portal for reporting potential insider threats. However, some employees might hesitate to use anonymous reporting due to fear of retaliation.

Which is the best way to encourage anonymous reporting within the contractor's organization?

87. During the planning and preparation discussions, a key member of the C3PAO Assessment team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team.

If the OSC Assessment Official asks the C3PAO for advice on how to proceed, the Lead Assessor, on behalf of the C3PAO, should do which of the following?

88. Mobile devices are increasingly becoming important in many contractor's day-to-day activities. Thus, the contractors must institute measures to ensure they are correctly identified, and that any connections are authorized, monitored, and logged, especially if the devices or their connections process, store, or transmit CUI.

You have been hired to assess a contractor's implementation of CMMC practices, one of which is AC. L2.3.1.18 (Mobile Device Connections). To successfully test the access control capabilities authorizing mobile device connections to organizational systems, you must first identify what a mobile device is. Mobile devices connecting to organizational systems must have a device-specific identifier.

Which of the following is the main consideration for a contractor when choosing an identifier?

89. As a CCA, you can assess an OSC's implementation of CMMC practices or assist OSCs in preparing for upcoming third-party assessments through two different roles. However, CCAs can only deliver certified services through a C3PAO.

What are these two roles?

90. When assessing a contractor's implementation of configuration management practices, you interview a system security manager to understand how best they have implemented CM.L2-3.4.4- Security Impact Analysis. They inform you that the contractor has a change review board that reviews any system changes and approves or rejects them. The system security manager is a member. Any configuration changes are tested, validated, and documented before installing them on the operational system. However, chatting with the development team, you learn that sometimes they patch vulnerabilities found by the penetration testing team without necessarily having to send recommended patches to the change review board. This is done to quickly address the vulnerabilities before they are exploited.

Which of the implementation strategies below can the contractor NOT use to be compliant with CM.L2-3.4.4-Security Impact Analysis?

91. When assessing a contractor's implementation of configuration management practices, you interview a system security manager to understand how best they have implemented CM.L2-3.4.4-Security Impact Analysis. They inform you the contractor has a change review board that reviews any system changes and approves or rejects them. The system security manager is a member. Any configuration changes are tested, validated, and documented before installing them on the operational system.

However, after chatting with the development team, you learn that sometimes they patch vulnerabilities found by the penetration testing team without necessarily having to send recommended patches to the change review board. This is aimed at quickly addressing the vulnerabilities before they are exploited.

Based on the scenario, what score does the contractor's implementation of CM.L2-3.4.4-Security Impact Analysis warrant?

92. To comply with CMMC requirement IR.L2-3.6.3-Incident Response Testing, organizations seeking certification (OSCs) must have a plan to regularly test their ability to respond to cyber incidents. This testing ensures that OSCs can effectively identify, contain, and recover from security breaches.

Which evidence artifact can an OSC NOT cite to show compliance with the practice?

93. Your organization has informed you that an OSC has contacted them for a prospective CMMC assessment. Your C3PAO has a specified number of days to acknowledge the request and proposes a date for the initial coordination call.

Who is responsible for overseeing and managing a dedicated CMMC Assessment Team for a specific OSC?

94. During your assessment of an OSC's implementation of security engineering principles throughout its system and software development lifecycles, you review their policies and interview personnel. The OSC has a documented security architecture that includes high-level security requirements such as data encryption, least privilege access controls, and input validation. However, this guidance remains fairly general.

You then examine the system design documentation for a key application processing CUI. Although security requirements are mentioned, there is no evidence that specific security engineering techniques such as threat modeling, layered protections, or secure design patterns were employed during the design phase. Interviews with the development team reveal limited experience with advanced security engineering practices beyond basic secure coding. The team admits they did not perform activities like misuse case analysis, abuse case modeling, or attack surface reviews during the design process.

In further testing, you find that the OSC has established secure coding standards, conducts static code analysis, and performs penetration testing before production releases. However, there are no documented processes for incorporating explicit security engineering activities during the design and architecture phases.

Based on your assessment and the evidence provided by the OSC, how would you score the implementation of CMMC practice SC.L2-3.13.2-Security Engineering during the assessment?

95. When undertaking their duties, an Assessment Team concludes there are gaps the OSC should address before certification. Displeased with the results, the OSC contracts another C3PAO, which convenes an Assessment Team to reassess it. The second Assessment Team finds the OSC has adequately implemented all 110 CMMC practices and issues a certification. Both C3PAOs are bound to the OSC by an NDA.

What should you do if the findings from the other C3PAO contradict your assessment?

96. A contractor has retained you to assess compliance with CMMC practices as part of their triennial review. During your assessment of the AU domain, you discovered that the contractor has recently installed new nodes and servers on their network infrastructure. To assess their implementation of AU.L2-3.3.7-Authoritative Time Source, you trigger some events documented to meet AU.L2-3.3.1-System Auditing across both the new and existing systems, generating audit logs.

Upon examining these logs, you notice inconsistencies in the time stamps between newly installed and previously existing nodes. Further investigation reveals that while the contractor has implemented a central Network Time Protocol (NTP) server as the authoritative time source, the new systems are configured to automatically adjust and synchronize their clocks only when the time difference with the NTP server exceeds 30 seconds.

How would you assess the contractor's implementation of AU.L2-3.3.7-Authoritative Time Source?

97. Mobile devices are increasingly becoming important in many contractors' day-to-day activities. Thus, the contractors must institute measures to ensure they are correctly identified, and that any connections are authorized, monitored, and logged, especially if the devices or their connections process, store, or transmit CUI.

You have been hired to assess a contractor's implementation of CMMC practices, one of which is AC. L2.3.1.18 (Mobile Device Connections). To successfully test the access control capabilities authorizing mobile device connections to organizational systems, you must first identify what a mobile device is.

Which of the following options does NOT describe a mobile device?

98. You are the Lead Assessor for a CMMC Assessment engagement with the OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts. During the review of the OSC's proposed CMMC Assessment Scope, you notice the OSC has included assets and networks not involved in handling CUI or related to federal contracts.

What should be your course of action?

99. Tina is working on a team conducting a Level 2 assessment for Humvees -R-Us (HRU). While gathering evidence, Tina notices that HRU has not updated several critical policies in years. Knowing that HRU is investing a significant amount of money in the assessment, she tells Bob, the CEO of HRU, that she will date the policies to make them appear as if they have been regularly revised. She explains that this will help HRU pass their assessment and save them the cost of a reassessment. Tina believes changing the dates isn’t a big deal since HRU has policies written but has not revised them as frequently as required. Was it right for Tina to adjust the dates during the assessment?

If not, which principle of the CMMC Code of Professional Conduct did she violate?

100. A contractor's system maintenance policy allows for non-local maintenance. It has implemented a strict access control policy, allowing only authorized personnel to initiate non-local maintenance sessions. The Access control policy is supported by using Common Access Cards (CACs) with automatic session timeouts to ensure maintenance connections are terminated when complete or inactive. The non-local maintenance team must use a secure VPN to establish connections with the contractor's facilities. However, people's identities or processes initiating the non-local maintenance sessions must be verified before authorization. The contractor also continually monitors active sessions to ensure they are legitimate and terminated after completion.

Which of the following evidence would NOT meet sufficiency and adequacy requirements to support a finding of Met?

101. You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin to determine the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment.

What is the primary focus of the 'Sufficiency' criterion during the evidence verification process in a CMMC assessment?

102. During your on-site CMMC assessment of an OSC, you determine that the organization is performing the practical aspects of PE.L1-3.10.3-Escort Visitors. However, upon further review, you notice their standard operating procedures (SOPs) do not align with the new processes being implemented by the outsourced security guard company they recently hired.

Given this discrepancy between the documented procedures and the actual implementation, what should the OSC do with respect to practice PE.L1-3.10.3-Escort Visitors?

103. A vulnerability scan on a defense contractor's system identifies a critical security flaw in a legacy database application that stores CUI. Remediating the flaw would require a complete overhaul of the application, causing significant downtime and potentially disrupting critical business functions. Given the potential consequences of remediation, the contractor is considering deferring the fix.

According to CMMC practice RA.L2-3.11.3 -Vulnerability Remediation, what factors should drive the prioritization of vulnerability remediation efforts?

104. You are the Lead Assessor assigned by your C3PAO to conduct a CMMC Assessment for a small manufacturing company, Precision Parts Inc. (PPI). During the initial coordination call with PPI's management team, you learn that PPI is a wholly-owned subsidiary of a larger corporation, Acme Manufacturing Holdings (AMH).

PPI operates as an independent business unit within AMH and has its own IT infrastructure and cybersecurity policies. You need to determine the appropriate corporate entity to be assessed as the "Organization Seeking Certification" (OSC).

If PPI outsources its payroll and human resources functions to an external service provider, HR Solutions, LLC, how would HR Solutions, LLC be categorized in the context of a CMMC assessment?

105. CMMC practice PS.L2-3.9.1-Screen Individuals, requires individuals to be screened before authorizing access to organizational systems containing CUI. However, in the assessment you are currently conducting, there is no physical evidence confirming the completion of personnel screens, such as background checks, only affirmations derived from an interview session. In an interview with the HR Manager, they inform you that before an individual is hired, they submit their information through a service that performs criminal and financial checks.

How would you score the OSC's implementation of CMMC practice PS.L2-3.9.1-Screen Individuals, objective [a]?

106. You are conducting a CMMC assessment for a contractor that handles sensitive defense project data. Reviewing their documentation shows the Contractor has an on-premises data center that houses CUI on internal servers and file shares. A corporate firewall protects this data center network.

However, the Contractor also uses a hybrid cloud infrastructure, storing some CUI in Microsoft Azure cloud storage, which can be accessed using ExpressRoute private network connections. Additionally, their engineers connect remotely to the data center to access CUI via a site-to-site VPN from their home networks.

What risks does the hybrid infrastructure with cloud storage and remote access introduce regarding CUI data flow?

107. The Cyber AB is the sole authorized certification and accreditation partner for the DoD in its CMMC program. It is responsible for overseeing and establishing a trained, qualified, and high-fidelity community of assessors, including C3PAOs and CCAs.

What is the main requirement before the Cyber AB can accredit an Assessor?

108. Removable media can pose significant cybersecurity risks to an organization if not adequately controlled and secured. Understanding the dangers of this, an OSC has crafted a meticulous removable media policy. It defines removable media, types of removable media, examples of removable media, etc.

The policy limits the use of removable media unless authorized; even then, the media must be scanned for malware. Organizational removable media has specific signatures unique to organizational systems and provided to a defined group of personnel. Any data stored on such media is encrypted, and the OSC has disabled autorun and closed some ports on their computer systems.

The contractor also has deployed an endpoint protection solution for every employee searched while entering or leaving the facility. Users must also pass through a walk-in metal detector to ensure they do not sneak in thumb drives or SD cards.

Which of the following does an OSC NOT have to define in their removable media use policy?

109. An Assessment Team is reviewing the network diagram provided by an OSC. The diagram will help the team understand how the OSC has set up assets across its network and determine whether it has implemented network separation and enclaves to protect its CUI. During the review, the team noticed the network diagram does not clearly delineate the boundaries between the enterprise and CUI environments, raising concerns about the assessment scope.

What should the Assessment Team do in this situation?

110. As a CCA, you lead an Assessment Team conducting a CMMC assessment for an OSC. During the assessment, the OSC CEO pulls you aside and offers you a substantial sum of money―$50,000―if you are willing to overlook certain noncompliance issues the company is aware of.

If you accept the money, which Guiding Principle of the Code of Professional Conduct (CoPC) would you be violating?

111. You are assessing a contractor with a well-defined personnel security policy and procedures for screening individuals before granting access to CUI as part of their CMMC compliance. However, chatting with the security guards, you discover the contractor sometimes grants temporary access to CUI systems before completing the screening process, citing operational urgency.

When examining the contractor's procedures addressing personnel screening, which background checks would you NOT expect to find included?

112. An OSC uses a third party in all system repairs and has hired an MSP for penetration testing. The third party comes for adaptive, preventive, perfective, or corrective system maintenance every three months, and the penetration tester does so continuously. Whenever the third party comes for maintenance, there's no documentation of the issues they tackled. On the other hand, the penetration tester delivers meticulously detailed documentation per their contract with the OSC.

To comply with CMMC practice MA.L2-3.7.1-Perform Maintenance, what should the OSC implement for the maintenance activities performed by the third-party vendor?

113. During a readiness assessment for CoolPlanes Inc., Liz, a CCA, discovers a folder of technical drawings and illustrations of the aircraft that CoolPlanes produces. Liz has a younger brother, J.D., who loves airplanes. She thinks a large printed copy of one of the illustrations would make an excellent gift for J.D.'s birthday next month. She copies the drawing and sends it to be printed on a large canvas when she gets home.

Which principle of the CMMC Code of Professional Conduct did Liz most likely violate?

114. During a CMMC assessment, the CCAs, CCPs, and Lead Assessor validate the assessment scope provided by the OSC. They must review documents and records specific to the agreed-upon scope and boundaries of the assessment. There are several documents the Assessment Team may review or analyze; some are required, while others are not.

Which of the following documents is NOT required when scoping a CMMC Assessment for Level 2 maturity?

115. In preparation for a CMMC Level 2 assessment, an OSC must ensure their CUI handling practices are fully compliant with the laws, regulations, and government-wide policies.

Which of the following Laws, Regulations, or Government-wide Policies does the OSC employee NOT have to acquaint themselves with?

116. An aerospace company stores backups of their design schematics (containing CUI) on a cloud service provider (CSP). The company enforces access controls through the CSP's interface, restricting access to authorized personnel only. However, the company has no formal policy requiring data encryption at rest within the CSP environment.

Data stored on the CSP's infrastructure is segregated, with CUI stored on a separate cluster from other data types. The CSP is authorized at a FedRAMP Moderate baseline, and the OSC regularly monitors access to backups. The CSP provides alerts for any suspicious activity that is detected.

In the context of CMMC practice MP.L2.3.8.9-Protect Backups, which of the following controls best addresses the confidentiality risk in the scenario, considering the existing measures?

117. The Cyber AB has completed an investigation into a report submitted by a CCA regarding a potential violation by another CCA. They have determined the violation falls within the scope of the relevant Industry Working Group's authority.

What is the likely course of action for the Cyber AB in this scenario?

118. During a social event after work, a CCA from your C3PAO team brags about providing "consulting advice" to an OSC they recently assessed for CMMC compliance. You know this directly violates the CoPC's restrictions on CCAs offering such services during an assessment.

What is your ethical obligation in this situation?

119. A defense contractor retains your services to assess their information systems for CMMC compliance, particularly configuration management. The contractor uses CFEngine 3 for automated configuration and maintenance of its computer systems and networks. While chatting with the network’s system admins, you realize they have deployed a modern compliance checking and monitoring tool. However, when examining their configuration management policy, you notice the contractor uses different security configurations than those recommended by product vendors. The system administrator informs you they do this to meet the minimum configuration baselines required to achieve compliance and align with organizational policy.

Based on your understanding of the CMMC Assessment Process, how would you score CM.L2-3.4.2-Security Configuration Enforcement if the contractor is tracking it in a POA&M?

120. A leading technology solutions provider works with various government agencies and commercial clients. To ensure the secure handling of CUI, the solutions provider has implemented a dedicated CUI enclave within its network infrastructure. As a Certified CMMC Assessor, you are tasked with assessing the scope of the solutions provider's CMMC requirements.

Which separation technique can the technology solutions provider use to isolate the network assets in its CUI enclave?

121. A defense contractor has implemented a secure wireless network infrastructure to support their operations and client engagements. They use the WPA2-Enterprise encryption protocol with AES-CCMP ciphers and the 802.1X port-based authentication framework to secure their wireless network.

The wireless network infrastructure includes a Remote Authentication Dial-In User Service (RADIUS) server for centralized authentication and authorization of wireless clients. The contractor has deployed multiple Wireless Access Points (WAPs) throughout their office premises, each with its own Service Set Identifier (SSID) and VLAN configuration. Before granting wireless access, the contractor's IT team verifies the device's compliance with their security standards and validates the user's credentials against the RADIUS server using EAP-TLS authentication.

Based on the scenario, which of the following statements BEST describes the contractor's compliance with CMMC AC.L2-3.1.16-Wireless Access Authorization?

122. You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts.

During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts.

If the OSC insists on excluding the subsidiary's network and assets from the CMMC Assessment Scope despite your recommendation to include them, what should you do?

123. When assessing an OSC as part of a C3PAO assessment team, you learn they conduct risk assessments whenever there is a considerable change in their overall security posture. However, after interviewing personnel responsible for risk assessments, you learn they have a documented policy of conducting risk assessments annually.

Where should you find this information?

124. You are performing an on-site assessment for a defense contractor that develops and manufactures embedded control systems for military drones. During your documentation review, you discover they have a System Security Plan (SSP) outlining a configuration management process. The SSP mentions the creation of baseline configurations for their drone control systems, but details are limited.

You interview the IT manager responsible for configuration management. They explain they use a commercial configuration management tool to capture hardware and software configurations for the drone systems. They confirm the baseline configurations include initial software versions but do not track firmware or network configurations. Additionally, while they update software versions through the tool, they do not have a documented process for reviewing and updating baseline configurations in response to security vulnerabilities or system modifications.

The IT manager mentioned using a commercial tool to capture hardware and software configurations. However, the scenario suggests potential gaps in the contractor's implementation of CM.L2-3.4.1-System Baselining.

Which of the following aspects is most likely NOT adequately addressed by their current practices?

125. Upon examining a contractor's Security and awareness training policy for compliance with AT.L2-3.2.2-Role-Based Training, you determine they offer their employees training on handling CUI securely. However, system auditors, system administrators, penetration testers, and other cybersecurity roles are provided biannual training on CUI handling and cybersecurity best practices. During your assessment, you reviewed their training materials and curriculum for network engineers. You found the training covers basic networking concepts and doesn't delve into secure network configuration practices or identify potential network security risks.

Which of the following best describes the likely outcome of this finding in your assessment report?

126. A C3PAO has hired a full-time CCA and included them in an Assessment Team sent to conduct a CMMC assessment. However, as part of their agreement with Cyber AB, the CCA and, by extension, the C3PAO are expected to uphold a set of values during the assessment.

What document sets the expectations for accredited and credentialed entities authorized to deliver CMMC services under Cyber AB licensing?

127. You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation.

As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment.

What does the criterion of 'Adequacy' primarily assess in the context of evidence collection for a CMMC assessment?

128. Regarding virtual data collection, which of the following actions is the highest priority?

129. One of the key areas the CCA wants to observe is how an OSC handles media sanitization, as required by the CMMC control MP.L2-3.8.4-Media Markings. The OSC arranges for the CCA to witness the organization's personnel performing a mock media sanitization process on a decommissioned hard drive. During the demonstration, the CCA carefully observes the steps taken by the OSC's team, verifying they follow the documented procedures and effectively sanitize the media as per the CMMC requirements. The CCA notes the team executes the process seamlessly and without any issues.

What is the outcome if a test or demonstration successfully demonstrates how a CMMC practice is implemented?

130. A C3PAO and OSC have agreed to proceed with CMMC assessment planning. The OSC assessment official and the C3PAO are working to determine the planning details and purview of the Assessment, which includes scoping.

When should the C3PAO and OSC conduct the high-level contract framing?

131. Examining an OSC's system design documentation, you notice they have implemented a CUI enclave and have a documented procedure addressing boundary protection. They have segmented their network into different zones, each having its own rules to allow or deny traffic.

The OSC has implemented strict firewall rules that deny all incoming and outgoing traffic by default, only allowing specific traffic as required. To automatically block unrecognized traffic patterns, the OSC has provisioned a state-of-the-art Intrusion Detection and Prevention System (IDPS). During an interview with the network administrator, you realize the OSC uses a whitelisting approach to explicitly allow only certain IP addresses, domains, or services to communicate with their system.

Their IT security team monitors network traffic to detect any unauthorized attempts to connect or communicate with their system. The scenario states that network traffic is monitored to detect unauthorized connection attempts.

Based on the scenario and your understanding of the CMMC scoring methodology, how would you score the OSC's implementation of CMMC practice SC.L2-3.13.6-Network Communication by Exception?

132. Change is a part of any production process and must be meticulously managed. System Change Management is a CMMC requirement, and you have been called in to assess the implementation of CMMC requirements. When examining the contractor’s change management policy, you realize there is a defined change advisory board that has a review and approval mandate for any proposed changes. The change advisory board maintains a change request system where all the changes are submitted and documented for easy tracking and review. The contractor also has a defined rollback plan defining what to do if the approved changes result in unexpected issues or vulnerabilities.

Why is it important that contractors implement CM.L2-3.4.3-System Change Management fully?

133. You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 - Report Recommended Assessment Results. You are preparing to present the final recommended findings to the OSC Assessment Official and participants during the Final Findings Briefing.

After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?

134. You are assessing a contractor that develops missile guidance software containing CUI data. The software developers have administrative privileges on their workstations to be able to install tools and edit configuration files needed for their jobs. However, you have noted that many of the developers have access to modifying components critical to system security, which is beyond what is needed for their specific roles.

Which of the following would be a way to implement AC.L2-3.1.5, Least Privilege in this situation?

135. Your organization has informed you that an OSC has contacted them for a prospective CMMC assessment. Your C3PAO has a specified number of days to acknowledge the request and proposes a date for the initial coordination call.

In the initial exchange, which of the following would you NOT do?

136. An OSC has produced two assessment scopes. When the Lead Assessor questioned the OSC POC about why they did it, they explained they process, store, or transmit FCI within one assessment scope and CUI in another.

Which scope will the OSC obtain a CMMC Level 2 Certification for?

137. During the assessment process, a CCA encounters a situation in which the evidence provided by the OSC raises concerns about its adequacy and alignment with the CMMC practice being assessed.

What priority factors must the CCA have considered to arrive at these concerns?

138. Assessing a DoD contractor, you observe they have implemented physical security measures to protect their facility housing organizational systems that process or store CUI. The facility has secure locks on all entrances, exits, and windows. Additionally, video surveillance cameras are installed at entry/exit points, and their feeds are monitored by security personnel. Feeds from areas where CUI is processed or stored and meeting rooms where executives meet to discuss things that have to do with CUI and other sensitive matters are segregated and stored on a designated server after monitoring.

Walking around the facility, you notice network cables are hanging from the walls. To pass through a door, personnel must swipe their access cards. However, you observe an employee holding the door for others to enter. Although power cables are placed in wiring closets, they aren't locked, and the cabling conduits are damaged.

Even without examining their policies and procedures or interviewing the guards or their incident response team, how would you score the OSC's implementation of CMMC practice PE.L2-3.10.2-Monitor Facility, using the DoD Assessment and Scoring Methodology?

139. During a CMMC assessment for an OSC, the POC mentioned they conducted a self-assessment beforehand. The self-assessment was part of the organization's preparations for the CMMC assessment by your C3PAO.

Which publication offers the best guidance for the self-assessment procedures OSCs might use for CMMC compliance?

140. Upon examining a contractor's Security and awareness training policy for compliance with AT.L2-3.2.2-Role-Based Training, you determine they offer their employees training on handling CUI securely. However, system auditors, system administrators, penetration testers, and other cybersecurity roles are all provided biannual training on CUI handling and cybersecurity best practices.

How would you assess the contractor's implementation of CMMC practice AT.L2-3.2.2-Role-Based Training?

141. During a CMMC assessment, you, as a CCA, are interviewing a key OSC employee with information security responsibilities about the access control procedures. As the interview progresses, you realize the initial information in the System Security Plan (SSP) doesn't fully align with the employee's explanation.

Based on the scenario and your role as a CCA, what is NOT one of your responsibilities as an assessment team member?

142. During your assessment of an OSC's implementation of security engineering principles throughout its system and software development lifecycles, you review their policies and interview personnel. The OSC has a documented security architecture that includes high-level security requirements such as data encryption, least privilege access controls, and input validation. However, this guidance remains fairly general.

You then examine the system design documentation for a key application processing CUI. Although security requirements are mentioned, there is no evidence that specific security engineering techniques such as threat modeling, layered protections, or secure design patterns were employed during the design phase. Interviews with the development team reveal limited experience with advanced security engineering practices beyond basic secure coding. The team admits they did not perform activities like misuse case analysis, abuse case modeling, or attack surface reviews during the design process.

In further testing, you find the OSC has established secure coding standards, conducts static code analysis, and performs penetration testing before production releases. However, there are no documented processes for incorporating explicit security engineering activities during the design and architecture phases.

Based on this scenario, how does the lack of documented processes for security engineering activities during the design and architecture phases most likely impact the security of the OSC's CUI? Chose the best answer.

143. s the Lead Assessor, you have split the Assessment Team into groups and assigned various tasks to each one. One group is tasked with testing the OSC's capability to block outbound file transfers. One of the team members in this group selects a random file from the digital evidence provided by the OSC and attempts to send it over FTP to their home computer. As the Lead Assessor, you hear that this is about to happen.

What action should you take in such a situation?

144. One of the most important roles in a CMMC Assessment is a CQAP. They have diverse but specific roles to perform during an assessment.

In which of the following ways can a CQAP NOT help a Lead Assessor and the Assessment Team during the assessment process?

145. Pre-assessment information must be uploaded to CMMC eMASS by the end of the planning phase (Phase 1).

Who uploads this information, and what happens if the pre-assessment information changes after the upload?

146. The OSC Assessment Official and the Lead Assessor have completed the Pre-Assessment Form and are ready to upload it to the eMASS system. However, before proceeding, the CMMC Quality Assurance Professional (CQAP) needs to ensure the data is properly structured in JavaScript Object Notation (JSON) format. The team is now considering the reasons for this requirement and its implications for their assessment process.

What is the primary purpose of structuring the Pre-Assessment Form data in the JavaScript Object Notation (JSON) format?

147. When examining procedures addressing system security plan development and implementation, you realize the contractor has developed an SSP that defines and documents system boundaries. The SSP also contains the non-applicable security requirements approved by designated authorities. It also outlines other essential aspects, such as relationships with or connection to other systems, how security requirements will be implemented, etc. Upon interviewing personnel with information security responsibilities, you realize the contractor has not reviewed or updated the SSP and has no defined timelines.

As a CCA, how would you score the contractor's implementation of CA.L2-3.12.4-System Security Plan?

148. You decide to interview the IT security team to understand if and how a contractor has implemented audit failure alerting. You learn they have deployed AlienVault OSSIM, a feature-rich security information and event management (SIEM) tool. The SIEM tool has been configured to send automatic alerts to system and network administrators if an event affects the audit logging process. Alerts are generated for the defined events that lead to failure in audit logging and can be found in the notification section of the SIEM portal. However, the alerts are sent to the specified personnel 24 hours after the occurrence of an event.

Which of the following events should the contractor have documented to meet the requirements of assessment objective [b] of AU.l2-3.3.4-Audit Failure Alerting?

149. CMMC practice CM.L2-3.4.9- User-Installed Software, requires OSCs to establish a policy controlling software installation, to ensure any software installations by any user follow the established policy, and to monitor user software installation.

Which of the following is NOT something the OSC can cite as evidence to demonstrate their efforts to meet the requirements of CM.L2-3.4.9-User-Installed Software?

150. You are the Lead Assessor for a CMMC assessment of an OSC that has previously obtained ISO 27001 certification for its information security management system. During the initial discussions, the OSC

requests that you consider their ISO 27001 certification and grant them credit toward their CMMC certification. They believe there is a significant overlap between CMMC and ISO 27001.

What should your response to the OSC be?

151. During a CMMC assessment, you discover that the OSC has implemented a security policy that directly conflicts with the CMMC guidelines. The OSC's management team insists their policy is sufficient and requests you certify them without requiring any changes to align with the CMMC requirements.

How should you handle this situation as a Certified CMMC Assessor (CCA)?

152. You have been hired to assess an OSC's implementation of secure password storage and transmission mechanisms. The OSC uses a popular identity and access management (IAM) solution from a reputable vendor to manage user authentication across their systems. During the assessment, you examine the IAM solution's configuration and documentation, which indicate that passwords are hashed using industry-standard algorithms like SHA-256 or bcrypt before being stored in the system's database. Additionally, the IAM solution leverages TLS encryption for all communications, ensuring that passwords are transmitted securely over the network.

Based on the information provided, how would you assess the OSC's compliance with CMMC practice IA.L2-3.5.10-Cryptographically-Protected Passwords, which requires organizations to store and transmit only cryptographically protected passwords?

153. CMMC practice MA.L2-3.7.3-Equipment Sanitization requires organizations to sanitize equipment leaving their facilities for off-site maintenance for CUI.

What standard would the OSC use to sanitize various media?