Free CMMC-CCA Exam Dumps Preview

A C3PAO and OSC have agreed to proceed with CMMC assessment planning. The OSC assessment official and the C3PAO are working to determine the planning details and purview of the Assessment, which includes scoping.

When should the C3PAO and OSC conduct the high-level contract framing?

After completing a CMMC assessment, the OSC should hash all the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide. However, you have just realized that this requirement was not fulfilled, and the OSC Assessment Official cannot be reached to confirm it was done. To avoid any issues, you quickly complete this step and later inform the OSC Assessment Official.

Which CoPC principle have you just violated by hashing the evidence artifacts in place of the OSC?

To verify the scope accuracy and integrity, a Lead Assessor asks for documents supporting some elements of the scope. However, the OSC states that the information is proprietary and requires that the Lead Assessor sign a Non-Disclosure Agreement (NDA) before granting access.

What should the Lead Assessor do?

To meet AC.L2-3.1.5: Least Privilege, the following procedure is established:

1. All employees are given a basic, non-privileged user account.
2. System Administrators are given a separate System Administrator account.
3. Database Administrators are given a separate Database Administrator account.

Which steps should be added to BEST meet all of the standards for least privilege?

As a Lead Assessor working with an OSC in preparation for an upcoming assessment, you request they appoint an Assessment Official. This is the individual you will collaborate with and who has the OSC's decision-making authority regarding the CMMC assessment. The OSC Assessment Official will lead and manage the OSC's engagement in the assessment.

As the Lead Assessor, you expect the OSC Assessment Official to have the following responsibilities, EXCEPT?

During a CMMC assessment, the OSC's IT manager asks the CCA if they can "fix" a non-compliant practice during the assessment to improve their score. The CCA declines and continues the assessment.

What CoPC principle does the CCA uphold by refusing to assist?

The Certification Assessment Readiness Review (CA-RR) aims to determine whether the OSC and the Assessment Team are ready to conduct the assessment as planned and within the allocated time.

It addresses all of the following aspects of readiness to conduct the assessment except which one?

You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. During the assessment, you find that the OSC has failed to meet the requirements for CMMC practice AU.L2-3.3.4 - Audit Failure Alerting.

According to the CMMC Assessment Process (CAP), which of the following should be your next step?

You are a CCA who is part of an Assessment Team conducting a CMMC assessment on an aerospace company. While analyzing their network architecture, you realize that it includes a Demilitarized Zone (DMZ) to host their public-facing web servers.

What is the primary purpose of a DMZ in a network architecture?

The SSP for an OSC undergoing an assessment categorizes a device in the inventory that wirelessly connects to the network.

In order to secure the connection of wireless devices that access a system that transmits, stores, or processes CUI, what are the requirements?

While completing the Level 2 Assessment, the Lead Assessor found that the OSC was deficient on a number of CMMC practices. Forty practices were scored as NOT MET, all on the Authorized Deficiency Corrections list. The OSC remediated 17 of those during closeout, leaving 23 practices still NOT MET.

What should the Lead Assessor recommend?

You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. During the evidence collection phase, you need to examine the OSC's policies and procedures related to the CMMC practice AC.L2-3.1.5
- Least Privilege.

Which of the following would be an appropriatesource of evidence for this practice?

John, a Certified CMMC Assessor, has been conducting CMMC assessments for several years. During a recent assessment at a defense contractor, he encountered several issues similar to challenges he had faced in previous assessments. Influenced by his past experiences, John's interpretation of the

contractor's practices was shaped by his preconceptions.

Which of the following is TRUE about John's interpretation?

During the assessment process, a CCA encounters a situation in which the evidence provided by the OSC raises concerns about its adequacy and alignment with the CMMC practice being assessed.

What priority factors must the CCA have considered to arrive at these concerns?

A CCA is prohibited from doing which of the following?

During a CMMC assessment, an OSC employee asks the CCA if their current security measures are "good enough" to pass the assessment. The CCA responds by saying, "I can't tell you that, but here's what the CMMC requires for this practice."

What principle of the CoPC does this response uphold?

Ron is the Lead Assessor for an OSC's CMMC assessment. His team has scheduled interviews and demonstrations with the OSC's system administrator, Olivia. However, on the first day, the CEO informs
Ron that Olivia is very ill and is unavailable. The CEO offers to be interviewed about Olivia's responsibilities instead, even though he does not actually perform those tasks.

What should Ron do in this scenario?

During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can provide a list of recommended vendors to improve their security practices after the assessment.

What should the Lead Assessor do?

You are assessing an OSC that uses various collaborative computing devices, such as video conferencing systems, networked whiteboards, and webcams, for remote meetings and presentations. During your assessment, you examine the OSC's collaborative device inventory and find that they have identified and documented all collaborative computing devices. Most of the identified devices have indicators, such as LED lights, that notify users when the devices are in use. The OSC has also implemented a policy prohibiting the remote activation of collaborative computing devices without user consent. However, you find that the webcams can be activated remotely by authorized IT personnel for troubleshooting purposes.

In addition to interviewing personnel, what other evidence would be helpful to assess the OSC's compliance with CMMC practice SC.L2-3.13.12 - Collaborative Device Control regarding the remote activation of webcams?

Video monitoring is used by an OSC to help meet PE.L2-3.10.2: Monitor Facility. The OSC's building has three external doors, each with badge access and a network-connected video camera above the door. The video cameras are connected to the same network as employee computers. The OSC contracted a local security company to provide surveillance services. The security company stores the recordings at its premises and requires access to the OSC's network to manage the video cameras.

Which factor is a clear negative finding for the OSC's assessment?

A company has a CUI enclave for handling all CUI processed, stored, and transmitted through the organization. While interviewing the IT manager, the CCA asks how assets that can, but are not intended to, handle CUI are identified. The IT manager refers to the CUI system's network diagram (which includes these assets) as well as the asset inventory (which lists these assets as Contractor Risk Managed Assets).

Which other artifact MUST also mention these assets?

You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery.

How will proper separation of duties help the contractor meet the intent of AC.L2-3.1.4 - Separation of Duties?

During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on the OSC's procedures around configuration management and endpoint security. The system administrator described how they build and deploy new systems, and noted that some users require specialized applications for their jobs.
Users have been asked to email IT when they install and run an additional application so IT can add it to their list of allowed software.

What must the CCA conclude?

As a Certified CMMC Assessor, you are part of a team assessing a small defense contractor. During the assessment, an employee being interviewed appears unsure about some security practices and asks for your advice on how to answer certain questions to make their compliance appear better.

As a Certified CMMC Assessor, what should you do in this situation?

An OSC is undergoing a CMMC Level 2 assessment, and the C3PAO Assessment Team has identified several practices that the organization has not yet fully implemented. During the assessment, the CCA notes significant progress by the OSC towards implementing control MP.L2-3.8.4 - Media Markings, but acknowledges that not all required steps have been completed. The CCA explains to the OSC that this partially implemented practice will need to be tracked in theLimited Practice Deficiency Correction Program.

How should CMMC practices tracked under the Limited Practice Deficiency Correction Program be scored?

An OSC is planning to have a C3PAO perform a CMMC Level 2 assessment. When validating the OSC's proposed assessment scope, you realize they use an ESP for various cybersecurity services.

What action must you, as a CCA, take regarding the ESP?

An Assessor is evaluating whether an OSC has implemented adequate controls to meet AC.L2-3.1.7: Privileged Functions. The OSC has procedures that define privileged vs. non-privileged account provisioning and an access control policy that restricts execution of certain functions only to privileged.

What might the Assessor do to further evaluate the implementation of this practice?

In ensuring it meets its mandates to protect CUI under CMMC, a contractor has implemented a robust, dynamic session lock with pattern-hiding displays to prevent access and viewing of data. After every 5 minutes of inactivity, the current session is locked and a blank, black screen with a battery life indicator is displayed.

How is Session Lock typically initiated?

A CCA has been selected to lead a team conducting a CMMC assessment for an OSC. However, it is later determined that the OSC's Point of Contact (POC) is the CCA's sister.

Could this represent a Conflict of Interest (COI)?
If yes, what CoPC guiding principle or practice may the CCA have violated?

You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices.

Which of the following is not one of the recommended methods for collecting evidence during a CMMC assessment?

An OSC seeking Level 2 certification is reviewing the physical security of their building. Currently, the building manager unlocks and locks the doors for business operations. The OSC would like the ability to automatically unlock the door for authorized personnel, track access individually, and maintain access history for all personnel.

The BEST approach is for the OSC to:

In order to perform an interview, the Lead Assessor MUST ensure interview questions are:

During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team.

If the OSC Assessment Official asks the C3PAO for advice on how to proceed, the Lead Assessor, on behalf of the C3PAO, should do which of the following?

A software development company uses a cloud-based source code repository and continuous integration/ continuous deployment (CI/CD) platform to manage its software development lifecycle. The cloud service provider hosts and manages the source code repository and CI/CD platform.

Which of the following statements accurately describes how the OSC should handle the cloud service provider's assets in the CMMC Assessment Scope?

You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 - Report Recommended Assessment Results. You are preparing to deliver the final recommended findings to the OSC Assessment Official and OSC participants during the Final Findings Briefing.

After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?

An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1 - System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet.

The following conditions hold true for CMMC practices ineligible for deficiency corrections EXCEPT?

During an assessment, the IT security engineers responsible for password policy for the OSC provided documentation that all passwords are protected using a one-way hashing methodology.
As a result, which statement is true?

During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team.

Can the Lead Assessor proceed with the assessment using a reduced assessment team size?

An OSC outsources all of its security incident and event monitoring work to a third-party SOC. Additionally, the OSC utilizes a cloud-hosted antivirus (AV) system to fulfill the requirement of having virus protection without hosting additional servers on-site.

During the scoping discussion, both the SOC and AV should be listed as what type of asset?

You are assessing a contractor's implementation for CMMC practice MA.L2-3.7.4 - Media Inspection by examining their maintenance records. You realize the maintenance logs identify a repeating problem. A recently installed central server has been experiencing issues affecting the performance of the contractor's information systems. This is confirmed by your interview with the contractor's IT team. You requested to investigate the server, and the IT team agreed. On the server, there is a file named conf.zip that gets your attention. You decide to open the file in an isolated computer for further review.

To your surprise, the file is a .exe used when testing the server for data exfiltration.

How should this incident be handled?

During your review of an OSC's system security controls, you focus on CMMC practice SC.L2-3.13.9 -
Connection Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network. The server operating system uses default settings for connection timeouts. Network security is managed through a central firewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, there is no documented policy or procedure outlining a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work.

The scenario mentions that the server uses default settings for connection timeouts.

What additional approach, besides relying solely on user awareness, could be implemented to achieve connection termination based on inactivity and comply with CMMC practice SC.L2-3.13.9 - Connection Termination?

Examining an OSC password policy, you learn that a password should have a minimum of 15 characters.
It also should have 3 uppercase, 2 special characters, and other alphanumeric characters. Passwords have to be changed every 45 days and cannot be easily tied to the account owner. Passwords cannot be reused until 30 cycles are complete. The OSC's systems send a temporary password to the user's email or authentication app, which is one of the events described in their password usage policy. However, a recent penetration test report shows that the generated temporary passwords did not have sufficient entropy, and an attacker may guess a temporary password through brute force attacks.

Which CMMC practice has the contractor successfully implemented?

An OSC specializing in developing directed energy systems plans to bid on a DoD contract to produce a
250kW High Energy Laser Weapon System (HELWS).

This system is to be deployed on military bases across the globe to protect U.S. servicemen against aerial threats, including mortars, rockets, and unmanned aerial vehicles (UAVs), as well as swarms of mini-UAVs. Because of the sensitivity of the information, the OSC has prohibited using emails to transmit information regarding the project, whether encrypted or otherwise.

They also have instituted procedures to remove CUI from the email system.
The documents containing project information from the DoD are likely to contain which banner marking?

An OSC has produced two assessment scopes. When the Lead Assessor questioned the OSC PoC why, they detailed that they process, store, or transmit FCI within one assessment scope and CUI in another.

Which scope will the OSC obtain a CMMC Level 2 certification for?

While conducting a CMMC Level 2 Third-Party Assessment of a small defense contractor, an assessor discovers that the contractor's Information Security Policy has no documented change records demonstrating executive approval. The IT director states that they will add change records in the future, but that other evidence exists.

Which documentation is MOST able to demonstrate persistent and habitual adherence to CMMC requirements?

While assessing an OSC, you realize they have given identifiers to systems, users, and processes.
Examining their documentation, you know they have assigned accounts uniquely to employees, contractors, and subcontractors. The OSC has an automated system that disables any identifiers that are left unused for 6 months. You also learn from interviewing IT security administrators that the OSC has defined a technical and documented policy where identifiers can only be reused after 12 months.

How is the OSC likely to consider CMMC practice IA.L2-3.5.5 - Identifier Reuse if you find issues with its implementation?

A C3PAO Assessment Team is conducting a CMMC Level 2 assessment for an OSC. During the assessment, the team finds that the OSC has not implemented a required practice due to a lack ofresources. The OSC requests a waiver from the CMMC requirements citing financial hardship.

What should the Lead Assessor tell the OSC?

During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can provide a preliminary score before the assessment is complete to help prioritize remediation efforts.

What should the Lead Assessor do?

Jane is a CCA leading a CMMC assessment for an OSC. During the evaluation, Jane discovers that the OSC's Chief Information Security Officer (CISO) is a former colleague with whom she had a contentious relationship in the past. Unbeknownst to the OSC, Jane still harbors resentment toward the CISO due to their previous conflicts. As the assessment progresses, Jane becomes increasingly critical of the CISO's security practices, scrutinizing every detail and finding fault despite the OSC's best efforts to demonstrate compliance.

Given this scenario, how can a Certified CMMC Assessor's personal bias impact the assessment of the OSC?

You are a CCA evaluating an OSC's proposed CMMC assessment scope when planning and preparing a CMMC assessment. The assessment scope is defined in CMMC Assessment Scope - Level 2.

Which statement best defines the assessment scope according to CMMC guidelines?

While assessing an OSC, you realize they have given identifiers to systems, users, and processes.
Examining their documentation, you know they have assigned accounts uniquely to employees,

contractors, and subcontractors. The OSC has an automated system that disables any identifiers that are left unused for 6 months. You also learn from interviewing IT security administrators that the OSC has defined a technical and documented policy where identifiers can only be reused after 12 months.

How is the OSC likely to consider CMMC practice IA.L2-3.5.5 - Identifier Reuse if you find issues with its implementation?

Jane is a CCA for a leading C3PAO. She is selected to be part of a team of four, headed by James, to assess how Micron Inc., an OSC, has implemented the requirements for a CMMC Level 2 certification.
However, she witnesses James striking a deal with Micron's CISO to manipulate some findings to ensure the OSC is certified.

What should Jane do?

When assessing an environment, the CCA determines that CUI is contained within an IoT device.

Which statement MUST be true?

During the assessment of a company, the CCA learns that 50% of employees work from home using remote access. After reviewing the Access Control policy and audit logs, the CCA is unsure how the system ensures only employees with correct privileges can access CUI. The CCA decides a Test of functionality is required.

Which question is of the LEAST concern to the CCA?

As a Certified CMMC Assessor (CCA), you evaluate an OSC's implementation of the AC.L2-3.1.11 -
Session Termination requirement during a CMMC Level 2 assessment. This requirement mandates the organization to automatically terminate a user session after defined conditions are met. During your assessment, you want to determine whether the OSC has properly defined theconditions that would trigger the automatic termination of a user session, as required by assessment objective [a].

Which of the following assessment objects would you most likely examine to make this determination?

When assessing a contractor's implementation of CMMC requirements, you realize they have multiple data centers and regional offices, each having its access control mechanisms and security perimeter. The contractor uses a remote access solution to allow external partners and employees to collaborate on projects that involve CUI. The solution requires routing configuration to ensure the remote access to CUI is not compromised.

Why should all traffic be routed through a managed Access Control point?

As a CCA, understanding the guiding principles of the CoPC can help you when you face situations in which you are asked to compromise your values and integrity.

Which of the following is NOT a guiding principle of the CoPC?

Assessing a DoD contractor, you observe they have implemented physical security measures to protect their facility housing organizational systems that process or store CUI. The facility has secure locks on all entrances, exits, and windows. Additionally, video surveillance cameras are installed at entry/exit points, and their feeds are monitored by security personnel. Feeds from areas where CUI is processed or stored and meeting rooms where executives meet to discuss things that have to do with CUI and other sensitive matters are segregated and stored on a designated server after monitoring. Walking around the facility, you notice network cables are hanging from the walls. To pass through a door, personnel must swipe their access cards. However, you observe an employee holding the door for others to enter. Although power cables are placed in wiring closets, they aren't locked, and the cabling conduits are damaged.

Which of the following is NOT a concern regarding the contractor's implementation of CMMC practice PE.L2-3.10.2 - Monitor Facility?

You are part of the Assessment Team assessing a small defense contractor. You learn that the contractor (ABC Manufacturing) outsources parts of its IT infrastructure and cybersecurity services to a reputable Managed Services Provider (MSP). During a CMMC assessment, the contractor's Assessment Official claims that several CMMC practices related to system security and monitoring are inherited from the MSP.

Which of the following actions should the Lead Assessor take?

During a CMMC assessment, the OSC's PoC asks the Lead Assessor if they can skip the daily checkpoint meetings to save time, promising to provide all evidence upfront.

What should the Lead Assessor do?

A manufacturing company is seeking Level 2 certification. The loading docks are currently accessible directly from the company's main parking lot, which may lead to unauthorized access to facilities.

Based on this information, how should this method be modified to BEST meet Level 2 requirements?

While conducting a CMMC Level 2 self-assessment, an organization's Chief Information Security Officer asks the system administrator for evidence that remote access is routed through fully managed access control points.

Which documentation would BEST demonstrate that all remote access is routed through managed access control points?

A CCA is conducting a CMMC assessment and notices that the OSC's evidence includes a policy document that is outdated by two years. The OSC insists that the policy is still in effect, but staff interviews indicate that newer, undocumented procedures are being followed.

How should the CCA handle this situation?

During a CMMC assessment, you review the OSC's documented procedures for access control.These procedures detail a user access request and approval process for the organization's Human Resources (HR) information system. You then interview IT personnel responsible for access control, who confirm the

documented procedures accurately reflect how access is managed for the HR system. However, the OSC's network diagram reveals the presence of other in-scope systems critical to their operations, such as their Engineering Design Database and Manufacturing Control System. Neither the documented procedures nor the interview addressed access control practices for these additional systems.

Based on the CMMC Assessment Process guidelines on evidence sufficiency, how would you characterize the evidence collected so far regarding access control?

A CCA is conducting a CMMC assessment and notices that the OSC's evidence includes screenshots of system configurations that are not dated. The OSC claims the screenshots are current.

How should the CCA proceed?

You have been hired to assess a contractor's implementation of remote access capabilities for information systems that handle CUI. While interviewing the network administrator, you realize they perform privileged activities remotely when at alternate worksites.

Which of the following is the BEST action the contractor can take to address the network administrator's remote execution of privileged activities, as per CMMC practice AC.L2-3.1.15 - Privileged Remote Access?

An OSC is undergoing a CMMC assessment by a C3PAO. The assessment team has been on-site for several days, reviewing the OSC's systems, policies, and procedures against the CMMC requirements.
Each day, the assessment team holds a "daily checkpoint" meeting with the OSC's security team and representatives. This checkpoint serves an important purpose in the overall assessment process.

What is the significance of the Daily Checkpoint meeting in the CMMC assessment process?

During an assessment, it is uncovered that a CCA worked as a consultant for the OSC through their RPO.
Unfortunately, the CCA didn't disclose this when their C3PAO appointed them to participate in the assessment.

Did the CCA behave professionally?
If not, what issues are likely to arise?

Removable media can pose significant cybersecurity risks to an organization if not adequately controlled and secured. Understanding the dangers of this, an OSC has crafted a meticulous removable media policy. It defines removable media, types of removable media, examples of removable media, etc. The
policy limits the use of removable media unless authorized; even then, the media must be scanned for
malware. Organizational removable media has specific signatures unique to organizational systems and provided to a defined group of personnel. Any data stored on such media is encrypted, and the OSC has

disabled autorun and closed some ports on their computer systems. The contractor also has deployed an endpoint protection solution for every employee searched while entering or leaving the facility. Users must also pass through a walk-in metal detector to ensure they do not sneak in thumb drives and SD cards.

Based on the OSC's effort, how would you score their implementation of CMMC practice MP.L2-3.8.7 - Removable Media?

In assessing an OSC's CUI handling practices, you learn they use an approved algorithm (AES-256) to encrypt the data to ensure its confidentiality. However, the encryption module they are using has not been validated under the FIPS 140 standard. The OSC believes that using an approved algorithm is sufficient to comply with the CMMC practice for CUI encryption requirements.

Which of the following would be the most appropriate next step for the assessor?

You are a CCA participating in an assessment exercise for an OSC. You have completed the exercise, and the OSC has hashed the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide.

What is the next step for your Assessment Team with respect to the Evidence Artifact Hashes?

During your review of an OSC's system security control, you focus on CMMC practice SC.L2-3.13.9 -
Connections Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network. The server operating system utilizes default settings for connection timeouts. Network security is managed through a central firewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, there is no documented policy or procedure outlining a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work.

Based on the scenario, what is the MOST concerning aspect from a CMMC compliance perspective regarding CMMC practice SC.L2-3.13.9 - Connections Termination?

An OSC has contracted a C3PAO to perform a Level 2 Assessment. As the Lead Assessor is analyzing the assessment requirements, it is found that the OSC does not have a document detailing the assessment scope.

How can this problem BEST be fixed?

CMMC practice PS.L2-3.9.1 - Screen Individuals requires individuals to be screened before authorizing access to organizational systems containing CUI. However, in the assessment you are currently conducting, there is no physical evidence confirming the completion of personnel screens, such as background checks, only affirmations derived from an interview session. In an interview with the HR
Manager, they informed you that before an individual is hired, they submit their information through a service that performs criminal and financial checks.

How would you score the OSC's implementation of CMMC practice PS.L2-3.9.1 - Screen Individuals, objective [a]?

A contractor plans to bid for a DoD contract and has installed new network file servers to separate their commercial and DoD work. When examining the server documentation, you realize that the server has some open ports. Upon further testing, you determine that the server has some default features that are not essential for file storage or transfer. The server has a default remote desktop functionality that allows users remote access to the server's desktop environment. Files are transferred by default using FTP, which is less secure than the Server Message Block (SMB) protocol. However, the contractor's operations do not require remote access capabilities. Although the roles of each system are defined in their configuration management policy, a user can install any application or service they need. After some interviews, you learn that this ensures every employee is comfortable using a system or software they are most conversant with, despite having defined services or software for carrying out specific functions.

Upon speaking with the OSC PoC when assessing CM.L2-3.4.6 - Least Functionality, they acknowledge deficiencies, place the practice in a POA&M, and request that you grant conditional certification.

How would you respond?

A CCA was part of an Assessment Team tasked with conducting a CMMC assessment for an OSC. Happy to have been part of the team that completed the assessment, the CCA posted the OSC's assessment results on their Twitter/X account.

Which CMMC Code of Professional Conduct (CoPC) principle has the CCA violated?

A CCA is asked to validate if an OSC has separated their systems containing CUI from other departments' systems on their local network.

Which of the following MUST the CCA assess?

John, a CCA, has been assigned by his C3PAO to conduct a CMMC assessment for an OSC. During the assessment, John notices that the OSC's security practices leave much to be desired. After speaking with the OSC's IT staff, John offers to connect them with a vendor he knows who sells a vulnerability management tool that could address some of their weaknesses.

According to the CMMC CoPC, which of the following best describes John's actions?

You are a Lead Assessor, and an OSC has engaged your C3PAO firm to conduct a CMMC assessment.
As the Lead Assessor, you are responsible for identifying, documenting, and communicating any potential risks that could impact the successful completion of the planned assessment. You need to evaluate various risk categories and develop mitigation plans to ensure a smooth assessment process.

If a member of the Assessment Team is at risk of being delayed and is unable to start the assessment on time, which of the following would be an appropriate mitigation plan?

Sarah, a Certified CMMC Assessor, is conducting an assessment for DataSecure, a cloud service provider that hosts various applications for the Defense Industrial Base (DIB). During the assessment, Sarah encounters a complex and highly specialized cloud architecture that leverages cutting-edge technologies such as containerization, serverless computing, and advanced security controls. As Sarah reviews the evidence provided by DataSecure for the relevant CMMC practices, she realizes that some of the evidence and implementations are unlike anything she has encountered in previous assessments.

What is the most appropriate action for Sarah to take as a CCA in this scenario?