The Lead Assessor is compiling the assessment results, which must contain the status for each of the applicable practices. Some practices have been placed in the limited practice deficiency correction program.
Multiple areas have been reviewed, including HQ, host units, and a specific enclave.
In order to properly report the findings, the Lead Assessor MUST:

• A.Identify items that were moved to the POA&M.
• B.Confirm the final findings are aggregated to the OSC level.
• C.Record the agreements made with the OSC Assessment Official.
• D.Ensure the report includes all of the evidence that has been collected.

Comment: *

Name: *

Email: *

Verification: *

You are assessing an OSC that utilizes containerization technology for deploying microservices within a Kubernetes cluster. These microservices leverage various JavaScript frameworks for functionality. While a mobile device management (MDM) solution secures company phones, access to these microservices is primarily through web interfaces. From a mobile code control perspective, what is the primary concern in this scenario?

• A.The lack of mobile device management (MDM) for access through web interfaces
• B.Containerization technology itself might introduce security vulnerabilities
• C.The use of JavaScript in containerized microservices
• D.The potential execution of unauthorized mobile code through web interfaces

Comment: *

Name: *

Email: *

Verification: *

While assessing an OSC, you realize they have given identifiers to systems, users, and processes. Examining their documentation, you know they have assigned accounts uniquely to employees, contractors, and subcontractors. The OSC has an automated system that disables any identifiers that are left unused for 6 months. You also learn from interviewing IT security administrators that the OSC has defined a technical and documented policy where identifiers can only be reused after 12 months. How would you score the contractor' s implementation of CMMC practice IA.L2-3.5.5 - Identifier Reuse?

• A.Not Met (-5 points)
• B.Met (+1 point)
• C.Met (+2 points)
• D.Met (+5 points)

Comment: *

Name: *

Email: *

Verification: *

When validating an OSC's proposed CMMC assessment scope, the Assessment Team finds that the OSC has properly categorized its assets. The OSC has contracted an External Service Provider (ESP) for various cybersecurity functions. The ESP has deployed FortiSIEM and Splunk for real-time security monitoring, threat intelligence, application monitoring, log management, and reporting. They also deployed Microsoft Intune and configured app protection policies blocking proscribed apps and those suspected of data exfiltration. What type of asset is the ESP?

• A.Contractor Risk Managed Asset (CRMA)
• B.Security Protection Asset (SPA)
• C.Out-of-scope asset
• D.CUI Asset

Comment: *

Name: *

Email: *

Verification: *

A CCA is prohibited from doing which of the following?

• A.Verifying key internal system boundaries
• B.Determining if physically separated assets contain CUI
• C.Ensuring the external system boundary is fully defined
• D.Examining whether communications are monitored at the external system boundary

Comment: *

Name: *

Email: *

Verification: *