An organization has contracted with a third party for system maintenance and support. The third-party personnel all work remotely. Which of the following should an assessor assure is in place?

• A.Only third-party personnel can perform system maintenance functions.
• B.Third-party personnel need to be identified and monitored while performing maintenance.
• C.The number of third-party personnel who can access the organization's systems concurrently is limited.
• D.Remote access to systems used by the third party for maintenance functions is terminated automatically based on a defined set of criteria.

Comment: *

Name: *

Email: *

Verification: *

Which of the following can be taken into consideration when assessing AC.L2-3.1.3 Privacy & Security Notices?

• A.System use notifications during system log-in
• B.Alerts received from Intrusion Detection and Protection devices
• C.Posters in the workplace warning of the dangers of phishing and shoulder-surfing
• D.Sending out notices in email reminding employees to be conscious of security concerns

Comment: *

Name: *

Email: *

Verification: *

After the Assessment Team has been formed and the OSC Point of Contact (PoC) and Assessment Official have been identified, your C3PAO appoints John as the Lead Assessor. During the kickoff meeting, John reassures the OSC Assessment Official not to worry; they are guaranteed to pass the CMMC assessment. If they don't, John has agreed to refund 40% of the assessment fee. Which of the following is true about John's behavior as a Certified CMMC Assessor?

• A.It is unprofessional.
• B.It is acceptable as it incentivizes the OSC to cooperate fully during the assessment process.
• C.It aligns with the principle of objectivity outlined in the Code of Professional Conduct by removing any potential conflict of interest.
• D.It demonstrates his confidence in the Assessment Team's abilities and the OSC's preparedness.

Comment: *

Name: *

Email: *

Verification: *

During the examination of evidence for access control procedures, you review an OSC's Access Control List (ACL). The ACL appears to include most user accounts, but you notice that it lacks entries for several newly hired employees. You also realize that some parts of the OSC's access control policy haven't been signed and endorsed by senior management. Additionally, you notice multiple attestations from employees who are not the proper system owners. How should you proceed when encountering an incomplete artifact, such as the missing personnel in the access control list?

• A.Request the OSC to provide a revised, complete version of the artifact within a specified timeframe.
• B.Disregard the incomplete artifact and rely on other evidence for the practice assessment.
• C.Document the incomplete artifact as an evidence gap and proceed with assessing the practice based on the available evidence.
• D.Mark the associated CMMC practice as 'NOT MET' due to the incomplete artifact.

Comment: *

Name: *

Email: *

Verification: *

A company receives data that they suspect is CUI, but it is not marked as such. What is an acceptable way for the company to handle unmarked potential CUI?

• A.Treat all data as CUI even if not marked.
• B.If data are not marked, then they are not CUI.
• C.Have a procedure for deleting unlabeled data.
• D.Have a procedure for proper handling of unlabeled data.

Comment: *

Name: *

Email: *

Verification: *