You have been sent to assess an OSC's implementation of CMMC practices, one of which is AC.L2-3.1.11 - Session Termination. You expect to find the following items when examining the contractor's list of conditions or trigger events requiring session termination, EXCEPT?

• A.Time-of-day restrictions on system use
• B.Organization-defined periods of user inactivity
• C.Pre-approved user activity for specific functionalities
• D.Targeted responses to certain types of incidents

Comment: *

Name: *

Email: *

Verification: *

You are a CCA participating in an assessment exercise for an OSC. You have completed the exercise, and the OSC has hashed the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide.
What is the next step for your Assessment Team with respect to the Evidence Artifact Hashes?

• A.Tell the OSC to encrypt the hash.
• B.Upload the Hashes to the OSC's CMMC eMASS.
• C.Upload them to your C3PAO's cloud instance.
• D.Nothing, the assessment is complete.

Comment: *

Name: *

Email: *

Verification: *

You are a CCA with an active and good standing on the Cyber AB Marketplace. An OSC has contracted your C3PAO for a prospective CMMC Assessment. The OSC provides signal processing services for the DoD.
You assisted the OSC in preparing for the upcoming CMMC assessment by conducting an initial evaluation of their implementation practices. With your background in cybersecurity and extensive experience, your C3PAO and Lead Assessor have selected you to join the Assessment Team. Based on this scenario, which of the following is the most important factor for the C3PAO to consider when assigning assessors to the Assessment Team?

• A.The Assessor's active status and good standing as a CMMC Certified Assessor or Professional, verified on the Cyber AB Marketplace, are important factors.
• B.The Assessor's hourly rate, especially for independent assessors.
• C.The Assessor's professional reputation within the CMMC ecosystem.
• D.The Assessor's specialization with the OSC's lines of business or industry sub-sector.

Comment: *

Name: *

Email: *

Verification: *

During your review of an OSC's system security control, you focus on CMMC practice SC.L2-3.13.9 - Connections Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network. The server operating system utilizes default settings for connection timeouts.
Network security is managed through a centralfirewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, there is no documented policy or procedure outlining a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work. The scenario describes using a central firewall for network security. How could the firewall be configured to help achieve the objectives of CMMC practice SC.L2-3.13.9 - Connections Termination, for the remote access application?

• A.Creating firewall rules to identify and terminate connections associated with the CUI access application that have been inactive for a predefined period
• B.Encrypting all traffic between the user device and the server to protect CUI in transit
• C.Implementing intrusion detection and prevention systems (IDS/IPS) to identify and block suspicious activity on the server
• D.Blocking all incoming traffic to the server hosting the CUI access application, except from authorized IP addresses

Comment: *

Name: *

Email: *

Verification: *

You are assessing a contractor's implementation for CMMC practice MA.L2-3.7.4 - Media Inspection by examining their maintenance records. You realize the maintenance logs identify a repeating problem. A recently installed central server has been experiencing issues affecting the performance of the contractor's information systems. This is confirmed by your interview with the contractor's IT team. You requested to investigate the server, and the IT team agreed. On the server, there is a file named conf.zip that gets your attention. You decide to open the file in an isolated computer for further review. To your surprise, the file is a .
exe used when testing the server for data exfiltration. How should this incident be handled?

• A.By immediately reporting it to the FBI's Cyber Division
• B.Decommissioning the server and installing a new one
• C.In accordance with the incident response plan
• D.By sandboxing the malicious code and continuing with business as usual

Comment: *

Name: *

Email: *

Verification: *