A contractor plans to bid for a DoD contract and has installed new network file servers to separate their commercial and DoD work. When examining the server documentation, you realize the server has some open ports. Upon further testing, you know that the server has some default features that are not essential for file storage or transfer. The server has a default remote desktop functionality that allows users remote access to the server's desktop environment. Files are transferred by default using FTP which is less secure than Server Message Block (SMB) protocol. However, the contractor's operations do not require remote access capabilities. Although the roles of each system are defined in their configuration management policy, a user can install any application or service they need. After some interviews, you learn that this ensures every employee is comfortable using a system or software they are most conversant with, despite having defined services or software for carrying out specific functions. Upon speaking with the OSC PoC when assessing CM.L2-3.4.6 Least Functionality, they acknowledge deficiencies, place the practice in a POA&M, and request that you grant conditional certification. How would you respond?
Answer(s): B
Comprehensive and Detailed In-Depth CM.L2-3.4.6 (5-point practice) requires "configuring systems to provide only essential capabilities." Open ports, unnecessary features, and user-installed software violate this. Per the CMMC Assessment Process (CAP), 5-point practices cannot be placed in a POA&M for conditional certification--they must be fully met. Granting conditional certification (D) violates the CoPC.Consulting (A) or walking out (C) aren't appropriate assessor responses. B aligns with CMMC rules.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), CM.L2-3.4.6: "No POA&M for 5-point practices." CAP v5.6.1: "5-point practices must be Met for certification."
https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf
After you ask to examine some audit records, the contractor's system administrator informs you that there is a process to follow before accessing them. The logs are hashed using SHA-512 algorithms, and the system administrator has to run an algorithm to recalculate the hashes for the audit records to verify their integrity before running a decryption algorithm to decrypt the data. Since this might take some time, you tour the facility while interviewing personnel with audit and accountability roles. You see an employee holding the door for another without using their physical access card. While interviewing the contractor's employees, you find that they can access all audit logging tools and tweak the settings according to their needs or requirements. Upon examining the contractor's access control policy, you realize they have not defined the measures to protect audit logging tools. Considering CMMC AU.L2-3.3.8 Audit Protection and best practices, which of the following is the MOST concerning finding regarding the employees' access to audit logging tools?
Answer(s): A
Comprehensive and Detailed In-Depth AU.L2-3.3.8 requires organizations to "protect audit information and audit logging tools from unauthorized access, modification, and deletion." Unrestricted employee access to audit logging tools, with the ability to modify settings, directly violates this by risking log integrity and authenticity--critical for security investigations. Door-holding (B) is a physical security issue unrelated to audit tools. Hash recalculation (C) is a procedural step, not a flaw. Encryption and hashing (D) are strengths, not concerns. The CMMC guide stresses limiting access to a defined subset of users.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), AU.L2-3.3.8: "Protect audit logging tools from unauthorized access and modification."NIST SP 800-171A, 3.3.8: "Examine access controls to ensure only authorized personnel can modify audit tools."
While assessing an OSC, you realize they have given identifiers to systems, users, and processes. Examining their documentation, you know they have assigned accounts uniquely to employees, contractors, and subcontractors. The OSC has an automated system that disables any identifiers that are left unused for 6 months. You also learn from interviewing IT security administrators that the OSC has defined a technical and documented policy where identifiers can only be reused after 12 months. How would you score the contractor's implementation of CMMC practice IA.L2-3.5.5 Identifier Reuse?
Comprehensive and Detailed In-Depth CMMC practice IA.L2-3.5.5 Identifier Reuse requires organizations to "prevent reuse of identifiers for a defined period." The objectives are: [a] defining a period after which inactive identifiers are disabled, and [b] defining a period before reuse is allowed. The OSC meets both:Disables unused identifiers after 6 months (objective [a]), Prevents reuse for 12 months (objective [b]).The scenario provides no evidence of deficiencies (e.g., reuse occurring before 12 months), and the process is automated and documented, fully satisfying the practice. Per the DoD Scoring Methodology, IA.L2-3.5.5 is a 1-point practice, scoring Met (+1) when fully implemented (B). Options C and D use incorrect point values (no 2-point or 5-point practices match this), and Not Met (A) requires evidence of failure.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), IA.L2-3.5.5: "Verify [a] a period is defined for disabling inactive identifiers, and [b] a period is defined preventing reuse." DoD Scoring Methodology: "1-point practice: Met = +1, Not Met = -1." NIST SP 800-171A, 3.5.5: "Examine policy and configs for defined disablement and reuse periods."
During an assessment, the OSC was found to have implemented 68% of CMMC practice SC.L2- 3.13.11 CUI Encryption. However, the OSC Assessment Official cited issues with the vendor for not fully implementing the practice. Nonetheless, it has been listed in their POA&M. Which of the following is true regarding the use of a POA&M during a CMMC assessment?
Comprehensive and Detailed In-Depth SC.L2-3.13.11 (5-point practice) requires full implementation for certification. Per CAP, a POA&M documents deficiencies but isn't a substitute for completion (A). Options B, C, and D contradict CMMC rules, as partial implementation or POA&M listing doesn't equate to Met status, especially for 5-point practices ineligible for POA&M deferral.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), SC.L2-3.13.11: "Full implementation required." CAP v5.6.1: "POA&M not a substitute for Met status."
When examining an OSC's procedures for addressing transmission integrity and confidentiality, you interview their system administrator and learn that they use Secure File Transfer Protocol (SFTP)for secure CUI transmission. The OSC employs AES-256 to encrypt data before transmitting it. Any external connections to their internal servers or systems can only occur via a VPN. All emails containing CUI are encrypted and sent using Secure/Multipurpose Internet Mail Extensions (S/MIME). Internal CUI transfers are conducted over WPA3 secure Wi-Fi. All areas of the OSC's facilities where CUI is stored or processed are secured with biometrics. To prevent unauthorized CUI exfiltration or transfer, the OSC has deployed a data loss prevention solution. During employee interviews, you learn they receive regular awareness training on the importance of data encryption during transmission. Additionally, they conduct regular audits of transmission protocols and encryption measures to ensure their effectiveness. While AES-256 is a strong encryption algorithm, according to CMMC practice SC.L2-3.13.8 Data in Transit, what additional factor is crucial for ensuring FIPS compliance with cryptographic modules used for protecting CUI in transit?
Answer(s): C
Comprehensive and Detailed In-Depth SC.L2-3.13.8 requires "implementing FIPS-validated cryptographic mechanisms to protect CUI confidentiality in transit." AES-256 is approved, but the module implementing it must be FIPS 140- 2/3 validated (C), per CMMC. Open-source (A), usability (B), and complexity (D) aren't FIPS requirements.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), SC.L2-3.13.8: "Use FIPS 140-2/3 validated modules for CUI transit."NIST SP 800-171A, 3.13.8: "Verify FIPS validation of crypto modules."
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.