Free CMMC-CCA Web TestEngine Demo

Q36 Single choice

An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1 - System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet.

The following conditions hold true for CMMC practices ineligible for deficiency corrections EXCEPT?

A
Practices that could lead to significant exploitation of the network or exfiltration of CUI.
B
Practices that were not implemented by the OSC prior to the current CMMC Assessment.
C
Practices listed on the OSC's Self-Assessment Practice Deficiency Tracker.
D
Practices that involve minor updates to existing policies or procedures but have been in place for a period of time.

CMMC-CCA Web TestEngine demo