An aerospace company has requested a CMMC assessment for an enclave only. Your team has verified that the company has a valid CAGE code and is registered with SAM.gov. However, the enclave has no separate CAGE code or SAM registration. Can the assessor proceed with the CMMC assessment solely for the enclave, or is an assessment of the entire aerospace company's network required?

• A.The assessor can proceed with the enclave assessment for CMMC Level 2 compliance.
• B.The assessor cannot proceed with the enclave assessment.
• C.The assessor must assess the entire company network.
• D.The assessor can proceed with the enclave assessment, but only for a lower CMMC level.

Comment: *

Name: *

Email: *

Verification: *

In validating the OSC's implementation of AC.L2-3.1.16: Wireless Access Authorization, the CCA observes various personal and non-enterprise devices connected to the OSC's Wi-Fi. Because organizations handle wireless access differently, the CCA must locate evidence showing who has ultimate authority over wireless access. Which authority is acceptable for authorizing wireless access?

• A.The CEO mandating IT to add their personal phone to the company Wi-Fi
• B.A written policy executed by the CEO listing the pre-authorization requirements for Wi-Fi connectivity
• C.The CEO emailing the company instructing everyone to put personal devices on the company Wi-Fi
• D.A detailed document from the head of IT with instructions on how to connect to the guest Wi-Fi network

Comment: *

Name: *

Email: *

Verification: *

An OSC has an established password policy. The OSC wants to improve its password protection security by implementing a single change. Which of the following is an acceptable element to add to the OSC's password policy?

• A.Require passwords to be changed every 18 months.
• B.Require passwords to be 5 to 7 characters long.
• C.Add the use of salted two-way cryptographic hashes of passwords.
• D.Add the use of salted one-way cryptographic hashes of passwords, where possible.

Comment: *

Name: *

Email: *

Verification: *

During a POA&M Close-Out Assessment, the Lead Assessor encounters a situation where the organization's corrective actions for a specific practice have inadvertently limited the effectiveness of another practice that was previously scored as 'MET' during the initial assessment. In this scenario, what should the Lead Assessor' s recommendation to their C3PAO be?

• A.Update the POA&M and recommend the organization for CMMC Level 2 Final Certification, adding the affected practice to the POA&M.
• B.Defer the recommendation and request the organization to undergo a full reassessment.
• C.Recommend the organization for CMMC Level 2 Final Certification.
• D.Recommend the organization not be granted CMMC Level 2 Final Certification.

Comment: *

Name: *

Email: *

Verification: *

Understanding that changes are critical in any production environment, a DoD contractor has instituted measures to manage them. All software changes can only be implemented by defined individuals. These changes must have gone through a rigorous change approval process and must be implemented from a secure server located in the company's headquarters. The personnel affecting the changes access the server room using access cards and an iris scan. To log into the server, they must enter their passwords to receive a one- time password (OTP), which must be keyed in within 2 minutes. After any changes are made, the chairperson of the contractor's Change Review Board and the CISO get a notification to approve the changes before they take effect. Based on the contractor's current implementation, how would you score their effort to address CM.
L2-3.4.5 - Access Restrictions for Change?

• A.Met (+1 point)
• B.Met (+5 points)
• C.Met (+3 points)
• D.Not Met (-5 points)

Comment: *

Name: *

Email: *

Verification: *