Steve is a Certified CMMC Assessor (CCA) who works for ACME Inc., which is both an RPO and a C3PAO.
His aunt Mary works for ABC Holdings, and based on this connection, Steve convinces her boss to hire ACME Inc. to help prepare for a CMMC assessment. Steve leads the team and successfully completes the engagement with ABC Holdings. Six months later, Mary informs Steve that ABC Holdings is ready to perform its CMMC Level 2 assessment. Steve jumps at the opportunity and convinces his management at ACME Inc. to assign him as the lead CCA along with two other employees. Which of the following is true about Steve's involvement in ABC Holdings' CMMC assessment?

• A.Steve has a conflict of interest and should not be involved in officially assessing ABC Holdings.
• B.Steve can participate in the CMMC assessment for ABC Holdings if they were bound by an NDA during the initial engagement.
• C.Since enough time has passed, Steve can remain objective and impartial in the assessment.
• D.Steve can participate in the assessment if he did not directly implement any security controls during the preparatory engagement.

Comment: *

Name: *

Email: *

Verification: *

An assessor reviews the OSC's data protection policy, which requires full disk encryption on company laptops. While interviewing employees, the assessor learns that employees sometimes access data while teleworking on laptops that do not have full disk encryption.
How should the assessor view the implementation of the OSC's policy?

• A.Acceptable because it requires full disk encryption of company laptops.
• B.Insufficient because there are teleworking instances where the policy is not followed.
• C.Acceptable as long as an equivalent technical safeguard is implemented for all teleworking scenarios.
• D.Insufficient because full disk encryption is not required for laptops to comply with CMMC requirements.

Comment: *

Name: *

Email: *

Verification: *

An OSC has provided its System Security Plan (SSP) as evidence for several CMMC practices related to system security. During your examination of the SSP, you discover a section outlining procedures for user access controls. However, upon further review, you find no mention of procedures for managing privileged accounts, which is a critical aspect of secure system access. According to the guidelines for examining evidence, what is the most appropriate course of action for the Lead Assessor in this scenario?

• A.Accept the SSP as sufficient evidence and move on to the next practice.
• B.Explain the discrepancy to the OSC but allow them to keep the existing SSP as evidence.
• C.Recommend that the CMMC practice related to user access controls be marked "Not Met" due to the missing procedures.
• D.Request additional evidence from the OSC that specifically addresses privileged account management.

Comment: *

Name: *

Email: *

Verification: *

An Assessor is evaluating controls put in place by an OSC to restrict the use of privileged accounts. The Assessor interviews privileged users and confirms that the OSC has both a policy and specific procedures governing the use of privileged accounts for security functions. What else could the Assessor evaluate to validate the assertions made by the interviewed OSC staff?

• A.Examine the system architecture of the OSC to identify privileged accounts
• B.Test the processes for non-privileged accounts to perform privileged functions
• C.Examine the procedure assigning privileged roles to non-privileged functions
• D.Test the processes for privileged accounts with privileged users

Comment: *

Name: *

Email: *

Verification: *

An OSC uses a web application for document management. Employees can access this application from any internet-connected device through a web browser. The application resides on servers in a secure data center managed by a third-party vendor. The OSC maintains separate servers within its network to store the documents. When employees use the web application to upload documents, what type of locations are they interacting with?

• A.A logical location for the web application and a physical location for the document storage servers
• B.A secure area within the OSC's data center
• C.The physical location of their internet-connected devices
• D.The physical location of the vendor's data center

Comment: *

Name: *

Email: *

Verification: *