Which term describes "the protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to. or modification of information"?
Correct Answer: C
Understanding the Concept of Security in CMMC 2.0 CMMC 2.0 aligns with federal cybersecurity standards, particularlyFISMA (Federal Information Security Modernization Act), NIST SP 800-171, and FAR 52.204-21. One key principle in these frameworks is the implementation of security measures that are appropriate for the risk level associated with the data being protected. The question describes security measures that are proportionate to therisk of loss, misuse, unauthorized access, or modificationof information. This matches the definition of"Adequate Security." Analyzing the Given Options A). Adopted security# Incorrect The term"adopted security"is not officially recognized in CMMC, NIST, or FISMA. Organizations adopt security policies, but the concept does not directly align with the question's definition. B). Adaptive security# Incorrect Adaptive securityrefers to adynamic cybersecurity modelwhere security measures continuously evolve based on real-time threats. While important, it does not directly match the definition in the question. C). Adequate security#Correct The term"adequate security"is defined inNIST SP 800-171, DFARS 252.204-7012, and FISMAas the level of protection that isproportional to the consequences and likelihood of a security incident. This aligns perfectly with the definition in the question. D). Advanced security# Incorrect Advanced securitytypically refers tohighly sophisticated cybersecurity mechanisms, such as AI-driven threat detection. However, the term does not explicitly relate to the concept of risk-based proportional security. Official References Supporting the Correct Answer FISMA (44 U.S.C. § 3552(b)(3)) Definesadequate securityas"protective measures commensurate with the risk and potential impact of unauthorized access, use, disclosure, disruption, modification, or destruction of information." This directly matches the question's wording. DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) Mandates that contractors apply"adequate security"to protect Controlled Unclassified Information (CUI). NIST SP 800-171 Rev. 2, Requirement 3.1.1 States that organizations must "limit system access to authorized users and implement adequate security protections to prevent unauthorized disclosure." CMMC 2.0 Documentation (Level 1 and Level 2 Requirements) Requires that organizationsapply adequate security measures in accordance with NIST SP 800-171to meet compliance standards. Conclusion The term"adequate security"is the correct answer because it is explicitly defined in federal cybersecurity frameworks asprotection proportional to risk and potential consequences. Thus, the verified answer is:
Question 102
The Level 1 practice description in CMMC is Foundational. What is the Level 2 practice description?
Correct Answer: B
Understanding CMMC 2.0 Levels and Their DescriptionsTheCybersecurity Maturity Model Certification (CMMC) 2.0consists ofthree levels, each representing increasing cybersecurity maturity: * Level 1 - Foundational * Focuses onbasic cyber hygiene * Implements17 practicesaligned withFAR 52.204-21 * Primarily protectsFederal Contract Information (FCI) * Level 2 - Advanced(Correct Answer) * Focuses onprotecting Controlled Unclassified Information (CUI) * Implements110 practicesaligned withNIST SP 800-171 * Requirestriennial third-party assessments for critical programs * Level 3 - Expert * Focuses onadvanced cybersecurityagainstAPT (Advanced Persistent Threats) * ImplementsNIST SP 800-171 and additional NIST SP 800-172 controls * Requirestriennial government-led assessments * TheCMMC 2.0 framework explicitly describes Level 2 as "Advanced." * Italigns with NIST SP 800-171to ensure robustCUI protection. * A. Expert (Incorrect)- This describesLevel 3, not Level 2. * C. Optimizing (Incorrect)- Not a defined CMMC level description. * D. Continuously Improved (Incorrect)- CMMC does not use this terminology. * The correct answer isB. Advanced, which accurately describesCMMC Level 2. References: CMMC 2.0 Model Overview CMMC 2.0 Scoping Guide NIST SP 800-171 & NIST SP 800-172
Question 103
Which term describes the process of granting or denying specific requests to obtain and use information, related information processing services, and enter specific physical facilities?
Correct Answer: A
Understanding Access Control in CMMCAccess control refers to the process ofgranting or denyingspecific requests to: * Obtain and use information * Access information processing services * Enter specific physical locations TheAccess Control (AC) domain in CMMCis based onNIST SP 800-171 (3.1 Access Control family)and includes requirements to: #Implement policies for granting and revoking access. #Restrict access to authorized personnel only. #Protect physical and digital assets from unauthorized access. Since the questionbroadly asks about the process of granting or denying access to information, services, and physical locations, the correct answer isA. Access Control. * B. Physical access control#Incorrect.Physical access controlis asubsetof access control that only applies tophysical locations(e.g., keycards, security guards, biometrics). The question includesinformation and services, makinggeneral access controlthe correct choice. * C. Mandatory access control (MAC)#Incorrect.MAC is a specific type of access controlwhere access is strictly enforced based onsecurity classifications(e.g., Top Secret, Secret, Confidential). The questiondoes not specify MAC, so this is incorrect. * D. Discretionary access control (DAC)#Incorrect.DAC is another specific type of access control, whereownersof data decide who can access it. The question asksgenerallyabout granting/denying access, makingaccess control (A)the best answer. Why the Other Answers Are Incorrect * CMMC 2.0 Model - AC.L2-3.1.1 to AC.L2-3.1.22- Covers access control requirements, includingcontrolling access to information, services, and physical spaces. * NIST SP 800-171 (3.1 - Access Control Family)- Defines the general principles of access control. CMMC Official ReferencesThus,option A (Access Control) is the correct answer, as it best aligns withCMMC access control requirements.
Question 104
While conducting a CMMC Assessment, a Lead Assessor is given documentation attesting to Level 1 identification and authentication practices by the OSC. The Lead Assessor asks the CCP to review the documentation to determine if identification and authentication controls are met. Which documentation BEST satisfies the requirements of IA.L1-3.5.1: Identify system users. processes acting on behalf of users, and devices?
Correct Answer: C
Understanding IA.L1-3.5.1 (Identification and Authentication Requirements)TheCMMC 2.0 Level 1practiceIA.L1-3.5.1aligns withNIST SP 800-171, Requirement 3.5.1, which mandates that organizationsidentify system users, processes acting on behalf of users, and devicesto ensure proper access control. To comply with this requirement, anOrganization Seeking Certification (OSC)must maintain documentation that demonstrates: A unique identifier (username) for each system user Mapping of system accounts to specific individuals Identification of devices and automated processes that access systems This documentation directly satisfies IA.L1-3.5.1because it showshow system users are uniquely identified and linked to specific accountswithin the environment. Alist of users and their assigned accountsconfirms that the organization has a structured method oftracking access and authentication. It allows auditors to verify thateach user has a distinct identityand that access control mechanisms are properly applied. A). Procedures for implementing access control lists (Incorrect) While access control lists (ACLs) are relevant for authorization, they do notidentify users or devicesspecifically, making them insufficient as primary evidence for IA.L1-3.5.1. B). List of unauthorized users that identifies their identities and roles (Incorrect) Identifying unauthorized users does not fulfill the requirement of trackingauthorizedusers, devices, and processes. D). Physical access policy stating "All non-employees must wear a special visitor pass or be escorted" (Incorrect) This pertains tophysical security, not system-baseduser identification and authentication. The correct answer isC. User names associated with system accounts assigned to those individuals, as thisdirectly satisfies the identification requirement of IA.L1-3.5.1. References: CMMC 2.0 Level 1 Practice IA.L1-3.5.1 NIST SP 800-171, Requirement 3.5.1
Question 105
A company has a government services division and a commercial services division. The government services division interacts exclusively with federal clients and regularly receives FCI. The commercial services division interacts exclusively with non-federal clients and processes only publicly available information. For this company's CMMC Level 1 Self-Assessment, how should the assets supporting the commercial services division be categorized?
