In ensuring it meets its mandates to protect CUI under CMMC, a contractor has implemented a robust, dynamic session lock with pattern-hiding displays to prevent access and viewing of data. After every 5 minutes of inactivity, the current session is locked and a blank, black screen with a battery life indicator is displayed. As a CCA, you will potentially use the following assessment methods to examine the contractor's implementation of session lock EXCEPT?

• A.Interview the system administrator
• B.Examine the system design documentation
• C.Test the strength of the user's password
• D.Test the mechanisms implementing the access control policy for session lock

Comment: *

Name: *

Email: *

Verification: *

While reviewing CA.L2-3.12.3: Security Control Monitoring, the CCA notices that the assessment period is defined as one year. An OSC's SSP states that under CA.L2-3.12.3, security controls are monitored using the same one-year periodicity to ensure the continued effectiveness of the controls. The assessor understands that some CMMC practices can reference other practices for the entirety of their implementation. Is the OSC's implementation under CA.L2-3.12.3: Security Control Monitoring acceptable?

• A.No, even when referencing other practices more description is always needed.
• B.No, monitoring must be conducted on an ongoing basis to ensure continued effectiveness.
• C.Yes, a one-year period for security control monitoring is acceptable.
• D.Yes, as long as CA.L2-3.12.1 has been scored as MET, they do need to be monitored.

Comment: *

Name: *

Email: *

Verification: *

An OSC allows some employees to use their personal devices (laptops, tablets) for work purposes. The OSC enforces a Bring Your Own Device (BYOD) policy that requires employees to install Mobile Device Management (MDM) software on their devices. The MDM allows for remotewiping of lost or stolen devices and enforces access control policies. Employees use VPNs to remotely access the OSC network from their personal devices. What challenges might a CCA face when collecting evidence to assess the OSC's compliance with AC.L2-3.1.12 - Control Remote Access?

• A.The use of MDM software simplifies evidence collection on mobile device security configurations
• B.The use of VPNs ensures a secure connection regardless of the device used for remote access
• C.Privacy concerns arise due to the personal nature of BYOD devices
• D.The CCA can rely solely on employee attestation to verify compliance with the BYOD policy

Comment: *

Name: *

Email: *

Verification: *

Does CMMC Level 2 require that a Cloud Service Provider (CSP) hold a FedRAMP HIGH authorization hosted in a government community cloud (GCC)?

• A.No. The CSP can obtain a FedRAMP MODERATE equivalency.
• B.No. The CSP must hold a FedRAMP MODERATE authorization.
• C.Yes. FedRAMP HIGH is required for CUI data controls due to the sensitive nature of the Defense Industrial Base systems.
• D.Yes. FedRAMP HIGH authorization demonstrates the CSP compliance with NIST SP 800-53 and SP
  800-171 control requirements.

Comment: *

Name: *

Email: *

Verification: *

The audit team is discussing the OSC's Risk Managed Assets. For these types of assets, the contractor need NOT:

• A.Provide a network diagram of the assessment scope.
• B.Ensure they are included in the pre-assessment discussion.
• C.Prepare for the assets to be assessed against CMMC practices.
• D.Show how they are being managed using organizational security policies.

Comment: *

Name: *

Email: *

Verification: *