Jane is a CCA for a leading C3PAO. She is selected to be part of a team of four, headed by James, to assess how Micron Inc., an OSC, has implemented the requirements for a CMMC Level 2 certification. However, she witnesses James striking a deal with Micron's CISO to manipulate some findings to ensure the OSC is certified. What should Jane do?

• A.Assume nothing happened and continue with the assessment.
• B.Privately request clarification from James.
• C.Ask for a bribe from James to keep quiet.
• D.Contact the DoD CIO and report James.

Comment: *

Name: *

Email: *

Verification: *

During a CMMC assessment, the Lead Assessor discovers that the OSC has outsourced its incident response to a third-party provider. The OSC provides a contract with the provider but no detailed evidence of the provider's processes. What should the Lead Assessor do?

• A.Accept the contract as sufficient evidence of incident response compliance.
• B.Request detailed evidence from the third-party provider demonstrating how they meet the CMMC incident response practice objectives.
• C.Score the incident response practice as "NOT MET" due to insufficient evidence.
• D.Terminate the assessment until the OSC implements incident response internally.

Comment: *

Name: *

Email: *

Verification: *

While examining the customer responsibility matrix submitted by the OSC for one of its Cloud Service Providers (CSPs), the Assessor notes that the matrix was substantially completed by the OSC's RPO. In fact, there is a statement from the RPO that the CSP has met the requirements for FedRAMP MODERATE.
In order to accept that this CSP is qualified to perform some of the practices on behalf of the OSC, what should occur?

• A.The CSP must have its service certified for FedRAMP by a certified C3PAO.
• B.The OSC should provide the contract documents for the CSP specifying that it must meet NIST SP 800-
  171 practices.
• C.The OSC must be able to demonstrate that the CSP is providing its services in a manner that complies with CMMC Level 2.
• D.There must be other evidence that an independent firm has confirmed the security controls meeting FedRAMP MODERATE are in place.

Comment: *

Name: *

Email: *

Verification: *

During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can exclude a small subsidiary from the assessment scope because it only handles a minimal amount of CUI. The subsidiary's systems are networked with the main OSC environment. What should the Lead Assessor do?

• A.Agree to exclude the subsidiary since it handles minimal CUI.
• B.Request the OSC to include the subsidiary in the scope due to its networked connection and CUI handling, and adjust the assessment accordingly.
• C.Proceed with the original scope and ignore the subsidiary's systems.
• D.Terminate the assessment until the OSC resolves the subsidiary's inclusion internally.

Comment: *

Name: *

Email: *

Verification: *

You are assessing Conedge Ltd, a contractor that develops cryptographic algorithms for classified government networks. In reviewing their network architecture documents, you see they have implemented role-based access controls on their workstations using Active Directory group policies. Software developers are assigned to the "Dev_Roles" group which grants access to compile and test code modules. The "Admin_Roles" group with elevated privileges for system administration activities is restricted to the IT staff. However, when you examine the event logs on a developer workstation, you find evidence that a developer was able to enable debugging permissions to access protected kernel memory - a privileged function. How should execution of the debugging permission be handled to align with AC.L2-3.1.7 - Privileged Functions?

• A.Require it to generate an email alert
• B.Perform automatic termination of the action
• C.Implement geo-IP blocking on the workstation
• D.Ensure it is logged to the central SIEM system

Comment: *

Name: *

Email: *

Verification: *