Free CMMC-CCA Web TestEngine Demo

Q70 Single choice

In assessing an OSC's CUI handling practices, you learn they use an approved algorithm (AES-256) to encrypt the data to ensure its confidentiality. However, the encryption module they are using has not been validated under the FIPS 140 standard. The OSC believes that using an approved algorithm is sufficient to comply with the CMMC practice for CUI encryption requirements.

Which of the following would be the most appropriate next step for the assessor?

A
Interview personnel responsible for cryptographic protection to determine if FIPS-validated cryptography is used elsewhere in the organization
B
Test the encryption mechanism by attempting to decrypt the encrypted data without the proper keys
C
Recommend that the OSC switch to a different, approved algorithm
D
Accept the OSC's implementation as compliant, given that they are using a strong encryption algorithm

CMMC-CCA Web TestEngine demo