A mid-sized company specializing in machining is preparing to bid for an upcoming DoD contract to provide machined components crucial for defense systems. As CMMC compliance will be required, the company's top executives have invited you to assess their implementation of CMMC Level 2 requirements. During your visit to their environment of operations, you discover that its production floor has several Computer Numerical Control (CNC) machines for precision machining, which are all connected to a local network for data transfer and control. The CNC machines receive design files from a central server in the company's data center and communicate with a SCADA quality control system that monitors production metrics and performance. The central server hosts the design files, which are only accessible to authorized engineers and operators and backed up in an Amazon EBS cloud instance to ensure availability across the company's multiple machining shops in different states. Furthermore, the company allows employees to upload designs to the server remotely using VPNs and virtual desktop instances. What is the BEST physical control the company can use for preventive purposes?
Answer(s): A
Comprehensive and Detailed In-Depth PE.L2-3.10.1 requires "limiting physical access to systems processing CUI." Proximity card readers (A) provide active, enforceable access control, preventing unauthorized entry to the production floor and data center, per CMMC intent. CCTVs (B) monitor, not prevent; banners (C) deter but don't enforce; locking entrances (D) is vague without authentication. The guide favors card-based systems.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), PE.L2-3.10.1: "Use card readers for preventive physical access control."NIST SP 800-171A, 3.10.1: "Examine active access controls like proximity cards."
https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf
You are conducting a CMMC assessment for a contractor that handles sensitive defense project data. Reviewing their documentation shows that the contractor has an on-premises data center that houses CUI on internal servers and file shares. A corporate firewall protects this data center network. However, the contractor also uses a hybrid cloud infrastructure, storing some CUI in Microsoft Azure cloud storage, which can be accessed using ExpressRoute private network connections. Additionally,their engineers connect remotely to the data center to access CUI via a site-to-site VPN from their home networks. Which of the following components of the contractor's environment should NOT be in scope when assessing practice AC.L2-3.1.3 Control CUI Flow?
Answer(s): D
Comprehensive and Detailed In-Depth AC.L2-3.1.3 requires organizations to "control the flow of CUI in accordance with approved authorizations." The scope includes systems and infrastructure that process, store, or transmit CUI, such as Azure cloud storage, on-premises servers, firewalls, ExpressRoute, and VPNs--all directly involved in CUI flow. Employees' homes, while the origin of VPN connections, are not part of the organizational system controlling CUI flow; the VPN endpoint at the contractor's network is. The CMMC guide focuses on organizational assets, not external user locations.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), AC.L2-3.1.3: "Scope includes systems and network components that process, store, or transmit CUI."NIST SP 800-171A, 3.1.3: "Examine system components involved in CUI flow, not external user environments."
You are assessing an OSC that develops applications handling Controlled Unclassified Information (CUI). As part of the assessment, you review their vulnerability scanning process. According to their risk assessment policy, the OSC conducts system vulnerability scans every three months. However, they also utilize a centralized, automated vulnerability scanning tool that performs daily scans. Upon discovering any vulnerabilities, the OSC's team applies patches and rescans their systems. Their environment includes backend database servers, web applications with custom Java code, virtual machine hosts running containerized applications, network firewalls, routers, switches, and developer workstations. During the assessment, you find that their scanning solution integrates the latest vulnerability feeds from the National Vulnerability Database (NVD), Open Vulnerability and Assessment Language (OVAL), and vendor sources. The tool generates reports using Common Vulnerability Scoring System (CVSS) metrics, and even remotely connected developer laptops are included in the scans. However, upon reviewing the vulnerability reports, you observe that the same high/critical vulnerabilities persist month after month without evidence of remediation.Furthermore, there is no record of source code scanning for their custom applications, and virtual machine hosts running the containerized applications are not included in the scans. Which of the following would be an appropriate compensating control or mitigation for the lack of source code scanning?
Answer(s): C
Comprehensive and Detailed In-Depth CMMC practice RA.L2-3.11.2 Vulnerability Scans requires organizations to "scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified." The OSC's process includes robust system scanning, but the lack of source code scanning for custom applications is a gap, as vulnerabilities in code can persist into production if not addressed at the development stage. While the practice doesn't explicitly mandate source code scanning, it's a critical component of a comprehensive vulnerability management program, especially for a software development OSC handling CUI. Among the options,performing periodic penetration testing and code reviews (C)is the most appropriate compensating control for the absence of automated source code scanning. Penetration testing simulates attacks to identify exploitable vulnerabilities in the application, while manual code reviews can uncover issues missed by system scans (e.g., logic flaws, insecure coding practices). This directly addresses the gap by ensuring vulnerabilities in custom code are identified and mitigated, aligning with the intent of RA.L2-3.11.2 to manage vulnerabilities effectively. Option A (Web Application Firewalls):WAFs can mitigate some runtime exploits but don't identify or fix underlying code vulnerabilities, making them a partial solution that doesn't fully compensate for the lack of scanning.Option B (Increase Scan Frequency):More frequent system scans won't detect code-level issues, as they target deployed systems, not source code.Option D (Secure Coding Standards):While proactive and valuable, standards prevent future issues but don't address existing vulnerabilities in current code, lacking the immediate compensatory effect needed.The CMMC Assessment Guide encourages compensating controls that directly tackle identified gaps, and penetration testing combined with code reviews is a recognized industry practice (e.g., NIST SP 800-53 CA-8, RA-5) for mitigating unaddressed code vulnerabilities.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), RA.L2-3.11.2: "Scan for vulnerabilities in systems and applications; remediation or mitigation required for identified issues." NIST SP 800-171A, 3.11.2: "Examine scanning processes; compensating controls like penetration testing can address gaps in vulnerability identification." Discussion Note: "Organizations may use additional methods (e.g., penetration testing) to identify vulnerabilities not covered by automated scans."
During your assessment of Defcon's (a contractor) implementation of CMMC Level 2 practices, you notice that their system for displaying security and privacy notices is insufficient. The banners currently in use lack detailed information about Controlled Unclassified Information (CUI)handling requirements and associated legal implications. Additionally, the banners are not consistently displayed across all contractor systems and workstations. Moreover, the banners on login pages disappear automatically after less than 5 seconds, providing insufficient time for users to read and acknowledge the content. Once the inconsistencies are addressed, when should the contractor's privacy and security notice be displayed?
Answer(s): B
Comprehensive and Detailed In-Depth AC.L2-3.1.9 requires "privacy and security notices consistent with applicable CUI rules" to be displayed at logon and when accessing CUI-related resources. Displaying notices only at logon (A) misses ongoing access points, while limiting to export-controlled data (C) is too narrow. Continuous display (D) is impractical and not required. The CMMC guide specifies initial logon and secondary notifications for CUI applications, ensuring users are reminded of obligations at key interaction points.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), AC.L2-3.1.9: "Display notices at logon and when accessing CUI-related applications."NIST SP 800-171A, 3.1.9: "Examine notices at initial logon and secondary access points."
A Defense Contractor is preparing for their upcoming CMMC Level 2 assessment. One of the key controls they need to address is CMMC practice MP.L2-3.8.5 Media Accountability, which deals with maintaining accountability for media containing CUI during transport outside of controlled areas. The organization regularly needs to transport physical media, such as hard drives and backup tapes, between their primary data center and an off-site storage facility. In the past, they have simply used standard packaging and commercial shipping services to move this media. Which of the following best describes a control that maintains accountability for media containing CUI during transport outside of controlled areas?
Comprehensive and Detailed In-Depth MP.L2-3.8.5 requires "maintaining accountability for media containing CUI during transport," including tracking and preventing tampering. Tamper-proof packaging and tracked shipping (A)directly ensure media accountability by providing evidence of integrity and location--meeting the practice's intent. Passwords (B), training (C), and system access (D) are unrelated to transport accountability. The CMMC guide highlights tracking and tamper resistance as key controls.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), MP.L2-3.8.5: "Use tamper-proof packaging and tracking to maintain accountability during transport."NIST SP 800-171A, 3.8.5: "Examine transport methods for tracking and tamper evidence."
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.