While conducting a CMMC Assessment, a Lead Assessor is given documentation attesting to Level 1 identification and authentication practices by the OSC. The Lead Assessor asks the CCP to review the documentation to determine if identification and authentication controls are met. Which documentation BEST satisfies the requirements of IA.L1-3.5.1: Identify system users. processes acting on behalf of users, and devices?
Correct Answer: C
Understanding IA.L1-3.5.1 (Identification and Authentication Requirements) TheCMMC 2.0 Level 1practiceIA.L1-3.5.1aligns withNIST SP 800-171, Requirement 3.5.1, which mandates that organizationsidentify system users, processes acting on behalf of users, and devicesto ensure proper access control. To comply with this requirement, anOrganization Seeking Certification (OSC)must maintain documentation that demonstrates: A unique identifier (username) for each system user Mapping of system accounts to specific individuals Identification of devices and automated processes that access systems Why "C. User names associated with system accounts assigned to those individuals" is Correct? This documentation directly satisfies IA.L1-3.5.1because it showshow system users are uniquely identified and linked to specific accountswithin the environment. Alist of users and their assigned accountsconfirms that the organization has a structured method oftracking access and authentication. It allows auditors to verify thateach user has a distinct identityand that access control mechanisms are properly applied. Why Other Answers Are Incorrect? A). Procedures for implementing access control lists (Incorrect) While access control lists (ACLs) are relevant for authorization, they do notidentify users or devicesspecifically, making them insufficient as primary evidence for IA.L1-3.5.1. B). List of unauthorized users that identifies their identities and roles (Incorrect) Identifying unauthorized users does not fulfill the requirement of trackingauthorizedusers, devices, and processes. D). Physical access policy stating "All non-employees must wear a special visitor pass or be escorted" (Incorrect) This pertains tophysical security, not system-baseduser identification and authentication. Conclusion The correct answer isC. User names associated with system accounts assigned to those individuals, as thisdirectly satisfies the identification requirement of IA.L1-3.5.1. References: CMMC 2.0 Level 1 Practice IA.L1-3.5.1 NIST SP 800-171, Requirement 3.5.1
Question 82
A C3PAO is conducting High Level Scoping for an OSC that requested an assessment Which term describes the people, processes, and technology that will be applied to the contract who are requesting a CMMC Level assessment?
Correct Answer: B
Question 83
An Assessment Team is conducting a Level 2 Assessment at the request of an OSC. The team has begun to score practices based on the evidence provided. At a MINIMUM what is required of the Assessment Team to determine if a practice is scored as MET?
Correct Answer: D
This question pertains to theminimum evidence requirementsneeded by a CMMCAssessment Teamto score a practice asMETduring aLevel 2 Assessment. The CMMC Level 2 assessment must align withNIST SP 800-171and follow the procedures outlined in theCMMC Assessment Process (CAP) Guide v1.0, particularly aroundevidence collection and scoring methodology. #Step 1: Refer to the CMMC Assessment Process (CAP) Guide v1.0 CAP v1.0 - Section 3.5.4: Evaluate Evidence and Score Practices "To assign a MET determination, the Assessment Team must collect and corroborate at least two types of objective evidence: either through examination of artifacts, interviews (affirmation), or testing (demonstration)." This meansat least two typesof the following evidence are required: Examine(documentation/artifacts), Interview(affirmation from personnel), Test(demonstration of implementation). #Step 2: Clarify the Official Minimum Standard for a Practice to be Scored MET The CAP explicitly states: "A practice can only be scored MET when a minimum oftwo types of evidencefrom the E-I-T (Examine, Interview, Test) triad are successfully collected and evaluated." Theevidence types must come from two different categories, for example: An artifact(Examine)+ an interview affirmation(Interview), A demonstration(Test)+ an interview(Interview), Etc. This cross-validation ensures that the control isimplemented, documented, and understoodby personnel - a core principle in assessing effective cybersecurity implementation. #Why the Other Options Are Incorrect A). All three types of evidence are documented for every control #Incorrect:While collecting all three types (E-I-T) strengthens the assessment, theminimum requirementis onlytwo. Collecting all three isnot requiredfor a practice to be scoredMET. B). Examine and accept evidence from one of the three evidence types #Incorrect:This fails to meet theminimum two-evidence-type requirementset by the CAP. Single-source evidence is not sufficient to score a practice as MET. C). Complete one of the following; examine two artifacts, observe one demonstration, or receive one affirmation #Incorrect:Even if two artifacts are examined,this is still only one type of evidence(Examine). The CAP requires twotypes- not two instances of the same type. #Why D is Correct D). Complete two of the following: examine one artifact, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel. #This directly reflects theCAP's requirement for collecting two different types of objective evidenceto determine a practice is MET. BLUF (Bottom Line Up Front): To score a CMMC Level 2 practice asMET, the Assessment Team must collecta minimum of two distinct types of evidence- from theExamine, Interview, Test (E-I-T)categories. This requirement is clearly stated in the CMMC Assessment Process (CAP) v1.0.
Question 84
Evidence gathered from an OSC is being reviewed. Based on the assessment and organizational scope, the Lead Assessor requests the Assessment Team to verify that the coverage by domain, practice. Host Unit. Supporting Organization/Unit, and enclaves are comprehensive enough to rate against each practice. Which criteria is the assessor referring to?
Correct Answer: C
Step 1: Understand the Definitions of Evidence Evaluation Criteria TheCMMC Assessment Process (CAP)introduces two key criteria for evaluating evidence: Adequacy- Does the evidencealign with the practice? Sufficiency- Is the evidencecomprehensive enoughin terms ofcoverage across systems, users, and scope? CAP v1.0 - Section 3.5.4: "Evidence must be evaluated for bothadequacy(is it the right evidence?) andsufficiency(is there enough of it across all in-scope assets and areas?) to score a practice as MET." #Step 2: Applying to the Scenario In the question, the Lead Assessor is asking the team toverify that evidence is sufficient across: Domains Practices Host Units Supporting Organizations Enclaves ##This is adirect reference to sufficiency, which evaluates whether thebreadth and depthof evidence is enough to make an informed judgment that the control is truly implemented across theentire assessed environment. #Why the Other Options Are Incorrect A). Adequacy #Adequacy refers to therelevanceof the evidence to the specific practice - not itscoverageacross scope. B). Capability #Not a term used in evidence validation within CMMC CAP documentation. D). Objectivity #While objectivity is important, it refers to theunbiased nature of assessment activities, not to theextent of evidence coverage. When an assessor evaluates whether the evidence is broad enough across all necessary systems, units, and enclaves to score a practice as MET, they are evaluatingsufficiency- one of the two core criteria for evidence validity in a CMMC assessment.
Question 85
For a CMMC Level 2 certification, which organization maintains a non-disclosure agreement with the OSC?
Correct Answer: B
The Certified Third-Party Assessment Organization (C3PAO) enters into a contractual relationship with the OSC. As part of that contract, the C3PAO maintains a non-disclosure agreement (NDA) to protect sensitive and proprietary information reviewed during the assessment. Supporting Extracts from Official Content: CAP v2.0, Roles and Responsibilities (§2.8): "The C3PAO maintains a non-disclosure agreement with the OSC to protect all sensitive information disclosed during the assessment." Why Option B is Correct: Only the C3PAO contracts directly with the OSC and is bound to protect assessment data. NIST, The Cyber AB (formerly CMMC-AB), and OUSD A&S do not enter NDAs directly with OSCs. References (Official CMMC v2.0 Content): CMMC Assessment Process (CAP) v2.0, Section on OSC-C3PAO agreements.
