An OSC outsources all of its security incident and event monitoring work to a third-party SOC. Additionally, the OSC utilizes a cloud-hosted antivirus (AV) system to fulfill the requirement of having virus protection without hosting additional servers on-site.
During the scoping discussion, both the SOC and AV should be listed as what type of asset?

• A.They are CUI Assets due to their operation within a CUI network.
• B.They are Out-of-Scope Assets due to being fully hosted/operated by third parties.
• C.They are Security Protection Assets due to their performance of security functions.
• D.They are Contractor Risk Managed Assets because they are not physically or logically isolated from CUI assets.

Comment: *

Name: *

Email: *

Verification: *

You are the Lead Assessor for a CMMC Level 2 Assessment of an OSC. During Phase 1 planning, the OSC's Assessment Official informs you that several key personnel who manage the in-scope IT systems will be unavailable during the scheduled assessment dates due to a company-wide training event. The Assessment Official asks if the assessment can proceed with substitute personnel who are less familiar with the systems.
What should you do?

• A.Proceed with the assessment using the substitute personnel, as long as they can provide some information about the systems.
• B.Agree to proceed but request that the OSC provide written documentation to compensate for the unavailable personnel.
• C.Reschedule the assessment to a time when the key personnel are available, as their participation is critical for an accurate assessment.
• D.Conduct the assessment virtually to accommodate the unavailable personnel.

Comment: *

Name: *

Email: *

Verification: *

While examining a contractor's audit and accountability policy, you realize they have documented types of events to be logged and defined content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activities. After the logs are analyzed, the results are fed into a system that automatically generates audit records stored for 30 days. However, mechanisms implementing system audit logging are lacking after several tests because they produce audit logs that are too limited. You find that generated logs cannot be independently used to identify the event they resulted from because the defined content specified therein is too limited. Additionally, you realize the logs are retained for
24 hours before they are automatically deleted. All of the following are required to satisfy AU.L2-3.3.1 - System Auditing assessment objectives [b] and [d], EXCEPT?

• A.Process identifiers
• B.Failure or success indications
• C.Timestamps
• D.File permissions

Comment: *

Name: *

Email: *

Verification: *

You decide to interview the IT security team to understand if and how a contractor has implemented audit failure alerting. You learn they have deployed AlienVault OSSIM, a feature-rich security information and event management (SIEM) tool. The SIEM tool has been configured to send automatic alerts to system and network administrators if an event affects the audit logging process. Alerts are generated for the defined events that lead to failure in audit logging and can be found in the notification section of the SIEM portal.
However, the alerts are sent to the specified personnel 24 hours after the occurrence of an event. As an assessor evaluating the implementation of AU.L2-3.3.4 - Audit Failure Alerting, which of the following would be a key consideration regarding the evidence provided by the contractor?

• A.Ensuring the defined alert notification methods (e.g., email, SMS) are secure and encrypted
• B.Verifying that the types of audit logging failures defined cover a comprehensive range of potential scenarios
• C.Determining if the documented personnel roles for alert notification align with the organization's hierarchy
• D.Checking if the alert notification process integrates with third-party monitoring services

Comment: *

Name: *

Email: *

Verification: *

A Lead Assessor and the OSC have been reviewing the scope. In preparing the final assessment scope, they disagree on some areas. After several days of attempting various solutions, they cannot find common ground.
What should the CCA recommend to the C3PAO?

• A.The C3PAO formally writes to the OSC to start CMMC scoping afresh.
• B.Halt the assessment until the assessment scope is verified.
• C.The assessment continues as they address the areas of contention.
• D.Inform the C3PAO that the OSC has failed the assessment.

Comment: *

Name: *

Email: *

Verification: *