An Assessment Team is reviewing a practice that is documented and being checked monthly. When reviewing the logs, the practice is only being completed quarterly. During the interviews, the team members say they perform the practice monthly but only document quarterly. Is this sufficient to pass the practice?
Correct Answer: A
Understanding CMMC Assessment Requirements CMMC assessments usethree assessment methodsto verify compliance with security practices: Examine- Reviewing documentation, policies, logs, or records. Interview- Speaking with personnel to confirm understanding and execution. Test- Verifying through technical or operational means that the practice is being performed. Assessment Findings in the Given Scenario Practice is documented as occurring monthly, but logs show quarterly execution. Interviews indicate monthly execution, but documentation does not support this claim. Why the Organization Fails the Practice Answer A (Incorrect): The work is being performed, but documentation is lacking, so the failure is not purely due to missing execution. Answer B (Incorrect): The documented frequency does not match the evidence in logs, so the practice is not being done asfully documented. Answer C (Correct):CMMC requires all three assessment methods (Examine, Interview, Test) to align. Since logs contradict the stated frequency, the practicefailscompliance. Answer D (Incorrect): Interview responses alone are not enough. The CMMCCAP GuideandNIST SP 800- 171Arequire corroboration with logs (Examine) and technical verification (Test). Conclusion The correct answer isC: To pass a practice, the organization mustprovide evidence across all three assessment methods. CMMC Assessment Process (CAP) Guide- Cyber AB NIST SP 800-171A- Assessing Security Requirements for CUI DoD CMMC 2.0 Scoping and Assessment Guide
Question 77
At which CMMC Level do the Security Assessment (CA) practices begin?
Correct Answer: B
Step 1: Understand the "CA" Domain - Security AssessmentTheCA (Security Assessment)domain includes practices related to: * Planning security assessments, * Performing periodic reviews, * Managing plans of action and milestones (POA&Ms). These practices derive fromNIST SP 800-171, specifically: * CA.2.157- Develop, document, and periodically update security plans, * CA.2.158- Periodically assess security controls, * CA.2.159- Develop and implement POA&Ms. * Level 1 (Foundational): * Implements only the17 practicesfromFAR 52.204-21 * Doesnot include the CA domain * Level 2 (Advanced): * Implements110 practicesfromNIST SP 800-171, including CA.2.157-159 * First levelwhereSecurity Assessment (CA)practices are required * Level 3: * Not yet finalized but intended to include selected controls fromNIST SP 800-172 #Step 2: Review CMMC Levels * A. Level 1# No CA domain practices are present at Level 1. * C. Level 3 / D. Level 4# These levels build on CA practices but do not represent thestarting point. #Why the Other Options Are Incorrect TheSecurity Assessment (CA)domain practices begin atCMMC Level 2, as part of the implementation ofNIST SP 800-171.
Question 78
Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1. Guidelines for Media Sanitation?
Correct Answer: A
Understanding NIST SP 800-88 Rev. 1 and Media Sanitization TheNIST Special Publication (SP) 800-88 Revision 1, Guidelines for Media Sanitization, provides guidance onsecure disposalof data from various types of storage media to prevent unauthorized access or recovery. Three Categories of Data Disposal in NIST SP 800-88 Rev. 1 Clear Useslogical techniquesto remove data from media, making it difficult to recover usingstandard system functions. Example:Overwriting all datawith binary zeros or ones on a hard drive. Applies to:Magnetic media, solid-state drives (SSD), and non-volatile memorywhen the media isreused within the same security environment. Purge Usesadvanced techniquesto make data recoveryinfeasible, even with forensic tools. Example:Degaussinga magnetic hard drive orcryptographic erasure(deleting encryption keys). Applies to:Media that is leaving organizational control or requires a higher level of assurance than "Clear". Destroy Physicallydamages the mediaso that data recovery isimpossible. Example:Shredding, incinerating, pulverizing, or disintegratingstorage devices. Applies to:Highly sensitive data that must be permanently eliminated. Why "A. Clear, Purge, Destroy" is Correct? B). Clear, Redact, Destroy (Incorrect)- "Redact" is a term used for document sanitization,notdata disposal. C). Clear, Overwrite, Purge (Incorrect)- "Overwrite" is a method within "Clear," but it isnot a top-level categoryin NIST SP 800-88. D). Clear, Overwrite, Destroy (Incorrect)- "Overwrite" is a sub-method of "Clear," but "Purge" is missing, making this incorrect. Conclusion The correct answer isA. Clear, Purge, Destroy, as these are thethree official categoriesof data disposal inNIST SP 800-88 Revision 1. References: NIST SP 800-88 Rev. 1 - Guidelines for Media Sanitization CMMC 2.0 Security Practices Related to Media Disposal(Aligned with NIST guidance)
Question 79
Which domains are a part of a Level 1 Self-Assessment?
Correct Answer: A
Question 80
An organization that manufactures night vision cameras is looking for help to address the gaps identified in physical access control systems. Which certified individual should they approach for implementation support?
Correct Answer: B
Anorganization seeking helpto address security gaps-such asphysical access control deficiencies-needs acertified professional who can provide implementation supportwithoutbeing involved in the actual CMMC assessment. Role of a Registered Practitioner (RP) A Registered Practitioner (RP)is a CMMC-certified individualwho provides consulting and implementation supportto organizations butdoes not perform assessments. RPs work independently from C3PAOsand canassist in fixing gapsin security controlsbeforeorafteran assessment. Since RPs are not assessors, they can provide direct remediation supportwithout any conflict of interest. Why "B. RP of an Organization Not Part of the Assessment" is Correct? The OSC needs assistance in implementing security controls(not assessment). An RP is trained and authorized to provide remediation and advisory services. Conflict of interest rules prevent the assessing C3PAO from providing implementation support. Why Other Answers Are Incorrect? A). CCA of the C3PAO performing the assessment (Incorrect) ACertified CMMC Assessor (CCA)is responsible for conducting the assessmentonly. TheC3PAO performing the assessment cannot also provide remediationdue to aconflict of interest. C). Practitioner of the Organization Performing the Assessment LTP (Incorrect) The assessmentLead Technical Practitioner (LTP)cannot provide remediation support for an OSC they are assessing. D). DoD Contract Official of the Organization Performing the Assessment (Incorrect) DoD Contract Officialsoversee contract compliance butdo not provide cybersecurity implementation support. Conclusion The correct answer isB. RP of an organization not part of the assessment, asonly independent RPs can assist with remediation and implementation support. References: CMMC 2.0 Registered Practitioner (RP) Program CMMC Code of Professional Conduct (CoPC) Conflict of Interest Policy CMMC 2.0 Assessment Process (CAP) Guide
