During an assessment, the IT security engineers responsible for password policy for the OSC provided documentation that all passwords are protected using a one-way hashing methodology. As a result, which statement is true?

• A.Passwords are protected in storage and in transit.
• B.Passwords are transmitted across the network as clear cipher-text.
• C.The password protection allows access but not authorization to assets.
• D.The transformation makes it impossible to re-convert the hashed password.

Comment: *

Name: *

Email: *

Verification: *

An OSC previously received a Conditional CMMC Level 2 Certification during Phase 3 of the assessment process. The OSC has been working on implementing a POA&M to address the practice deficiencies identified during the initial assessment. Now, within 180 days from the Final Recommended Findings Briefing, you are to conduct a POA&M Closeout Assessment. As the Lead Assessor, you and your assessment team review the OSC's updated POA&M, accompanying evidence, and any scheduled observations, interviews, or tests with the aim of validating the implementation of the corrective actions. If the Organization Seeking Certification (OSC) disagrees with the C3PAO's findings during the POA&M Closeout Assessment, what is the recourse?

• A.Immediately reapply for CMMC Level 2 certification with a different C3PAO.
• B.Submit an appeal using the Assessment Appeals Process outlined in the CAP.
• C.Request an extension of the timeline for corrective actions.
• D.Demand a reassessment by the same C3PAO and Lead Assessor.

Comment: *

Name: *

Email: *

Verification: *

A company has a CUI enclave for handling all CUI processed, stored, and transmitted through the organization. While interviewing the IT manager, the CCA asks how assets that can, but are not intended to, handle CUI are identified. The IT manager refers to the CUI system's network diagram (which includes these assets) as well as the asset inventory (which lists these assets as Contractor Risk Managed Assets). Which other artifact MUST also mention these assets?

• A.The identification and authentication policy should show how these assets are identified.
• B.The physical protection policy should list these assets as being part of the physical environment of the organization.
• C.The awareness and training program should include these assets so they are covered for all employees.
• D.The SSP should show these assets are managed using the company's risk-based security policies, procedures, and practices.

Comment: *

Name: *

Email: *

Verification: *

An OSC is planning a CMMC Level 2 assessment that your C3PAO will conduct. In Phase 1.6.1 - Access and Verify Evidence, as the Lead Assessor, you are verifying the existence and accessibility of the evidence provided by the OSC. While reviewing the list of evidence mapped against the CMMC practices, you discover that the OSC cannot locate several critical system security policies for key IT systems supporting their DoD contracts. These missing policies are essential for demonstrating compliance with various CMMC practices related to access control, incident response, and system maintenance. According to the CMMC Assessment Process (CAP), which of the following is not permitted for the Lead Assessor to do during the evidence verification stage?

• A.Review the content of the evidence to identify potential weaknesses.
• B.Ensure that no proprietary data is included in the evidence for review.
• C.Verify that the evidence exists and is accessible.
• D.Offer advice on how the OSC can improve the sufficiency of their evidence.

Comment: *

Name: *

Email: *

Verification: *

FIPS-validated cryptography is required to meet CMMC practices that protect CUI when transmitted or stored outside the OSC's CMMC enclave. What source does the CCA use to verify that the cryptography the OSC has implemented is FIPS-validated?

• A.Cryptographic section of the OSC's SSP
• B.Vendor cryptographic module documentation
• C.NIST Module Validation Program
• D.Cryptographic section of the Shared Responsibility Matrix

Comment: *

Name: *

Email: *

Verification: *