An OSC can use either of the following strategies to meet the requirements of CMMC practice MP.L2- 3.8.8 Shared Media, EXCEPT?
Answer(s): A
Comprehensive and Detailed In-Depth MP.L2-3.8.8 Shared Media requires organizations to "prohibit the use of portable storage devices containing CUI when such devices have no identifiable owner." Options B, C, and D enforce ownership and control (labeling, registration, policy), aligning with the practice. Permitting unrestricted use after training (A) fails to ensure ownership, violating the practice's intent, even with awareness training. The CMMC guide mandates identifiable ownership, not just training.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), MP.L2-3.8.8: "Prohibit use of portable devices without identifiable owners; training alone insufficient."NIST SP 800-171A, 3.8.8: "Examine controls ensuring device ownership."
https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf
An OSC uses a third party in all system repairs and has hired an MSP for penetration testing. The third party comes for either adaptive, preventative, perfective, or corrective system maintenance every three months, and the penetration tester does so continuously. Whenever the third party comes for maintenance, there's no documentation of the issues they tackled. On the other hand, the penetration tester delivers meticulously detailed documentation per their contract with the OSC. To comply with CMMC practice MA.L2-3.7.1 Perform Maintenance, what should the OSC implement for the maintenance activities performed by the third-party vendor?
Answer(s): C
Comprehensive and Detailed In-Depth MA.L2-3.7.1 requires "performing and documenting maintenance on systems." The lack of documentation from the third party fails this objective. Requiring logs (C) ensures evidence ofmaintenance activities, aligning with CMMC. Frequency (A), in-house work (B), and MSP use (D) don't address documentation needs. The guide mandates records for compliance.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), MA.L2-3.7.1: "Document maintenance activities." NIST SP 800-171A, 3.7.1: "Examine maintenance logs."
CMMC MA.L2-3.7.6 Maintenance Personnel requires that maintenance personnel without required access authorization be supervised during maintenance activities. One of the ways organizations can achieve this is to develop a documented procedure for supervised maintenance activities. Which of the following elements should be excluded from the documented procedure?
Comprehensive and Detailed In-Depth MA.L2-3.7.6 requires "supervising maintenance personnel without access authorization." Procedures should focus on supervision logistics: steps for personnel (B), IT contact (C), and supervisor monitoring (D). A list of CUI assets (A) is unnecessary and impractical, as it may vary per task and isn't required for supervision, per the CMMC guide.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), MA.L2-3.7.6: "Include supervision steps, not asset lists." NIST SP 800-171A, 3.7.6: "Examine supervision procedures."
A contractor is preparing to bid on an upcoming DoD contract to provide next-generation upper limb prosthetics for injured servicemen. Part of the preparation is undergoing a CMMC assessment, and they have hired you to assess their implementation of CMMC practices. The contractor has multiple design, manufacturing, and supply chain management systems. Each system generates its audit logs, which are stored in separate repositories. Different teams analyze and review them independently, with each team reporting the findings to the respective departmental heads. For instance, the engineering team reviews and analyzes logs related to the design systems and reports to the lead engineer, while the operations team focuses on the manufacturing system logs. When interviewing personnel responsible for audit record review, analysis, and reporting, they inform you that this is deliberately set up to ensure departmental independence and granular risk identification. Based on the CMMC practice AU.L2-3.3.5 Audit Correlation, what is the likely issue you would identify with the contractor's current approach?
Answer(s): B
Comprehensive and Detailed In-Depth AU.L2-3.3.5 requires organizations to "correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, or suspicious activity." The contractor's siloed approach, with separate teams and repositories, lacks correlation across systems, undermining the ability to detect organization-wide patterns or incidents. While departmental independence may aid granular risk identification, it doesn't meet the practice's requirement for integrated correlation. The other options (A, C, D) aren't directly supported by the scenario--processes exist, automation isn't mandated, and retention isn't addressed.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), AU.L2-3.3.5: "Correlate audit record review across systems to support investigation of suspicious activity."NIST SP 800-171A, 3.3.5: "Examine processes to ensure correlation across differentsystems and repositories."
Understanding that changes are critical in any production environment, a DoD contractor has instituted measures to manage them. All software changes can only be implemented by defined individuals. These changes must have gone through a rigorous change approval process and must be implemented from a secure server located in the company's headquarters. The personnel affecting the changes access the server room using access cards and an iris scan. To log into the server, they must enter their passwords to receive a one-time password (OTP), which must be keyed in within 2 minutes. After any changes are made, the chairperson of the contractor's Change Review Board and the CISO get a notification to approve the changes before they take effect. Based on the contractor's current implementation, how would you score their effort to address CM.L2-3.4.5 Access Restrictions for Change?
Comprehensive and Detailed In-Depth CM.L2-3.4.5 (5-point practice) requires "defining, documenting, approving, and enforcing access restrictions for changes." The contractor's measures (defined roles, approval process, secure access, notifications) fully meet these objectives, scoring Met (+5). No deficiencies suggest Not Met (D), and A/C use incorrect point values.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), CM.L2-3.4.5: "Enforce change access restrictions fully." DoD Scoring Methodology: "5-point practice: Met = +5, Not Met = -5."
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.