You have been sent to assess an OSC's implementation of CMMC practices, one of which is AC.L2- 3.1.11 Session Termination. In assessing the contractor's implementation of AC.L2-3.1.11, you'll likely need to examine the following specifications, EXCEPT?
Answer(s): A
Comprehensive and Detailed In-Depth AC.L2-3.1.11 involves "terminating user sessions after defined conditions." Specifications (documented artifacts like policies and plans--B, C, D) define these conditions and are examinable per NIST SP 800-171A. Mechanisms (A) are technical implementations, not specifications, and are tested, not examined as documents. The CMMC guide distinguishes between examining policies and testing mechanisms.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), AC.L2-3.1.11: "Examine policies and plans; test termination mechanisms."NIST SP 800-171A, 3.1.11: "Specifications include policies, not mechanisms."
https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf
Removable media can pose significant cybersecurity risks to an organization if not adequately controlled and secured. Understanding the dangers of this, an OSC has crafted a meticulous removable media policy. It defines removable media, types of removable media, examples of removable media, etc. The policy limits the use of removable media unless authorized; even then, the media must be scanned for malware. Organizational removable media has specific signatures unique to organizational systems and provided to a defined group of personnel. Any data stored on such media is encrypted, and the OSC has disabled autorun and closed some ports on their computer systems. The contractor also has deployed an endpoint protection solution for every employee searched while entering or leaving the facility. Users must also pass through a walk-in metal detector to ensure they do not sneak in thumb drives and SD cards. Based on the OSC's effort, how would you score their implementation of CMMC practice MP.L2-3.8.7 Removable Media?
Answer(s): B
Comprehensive and Detailed In-Depth MP.L2-3.8.7 requires "controlling removable media use on systems." The OSC's policy, restrictions, scanning, encryption, and technical/physical controls fully meet this, scoring Met (+1) for this 1-point practice. No gaps suggest Partial (C) or Not Met (D), and N/A (A) doesn't apply.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), MP.L2-3.8.7: "Control removable media with policy, scanning, and encryption."DoD Scoring Methodology: "1-point practice: Met = +1."
When assessing a contractor's implementation of CMMC requirements, you realize they have multiple data centers and regional offices, each having its access control mechanisms and security perimeter. The contractor uses a remote access solution to allow external partners and employees to collaborate on projects that involve CUI. The solution requires routing configuration to ensure the remote access to CUI is not compromised. In assessing the contractor's implementation of AC.L2- 3.1.14 Remote Access Routing, what must you determine?
Comprehensive and Detailed In-Depth AC.L2-3.1.14 requires organizations to "route remote access through managed network access control points." The assessor must confirm that these points are identified, implemented, and usedto channel all remote CUI access (B), ensuring centralized control and security. Managing points alone (A) isn't enough without routing, monitoring (C) is a separate practice (AC.L2-3.1.13), and authentication (D) is covered by AC.L2-3.1.12. The CMMC guide specifies both identification and routing as objectives.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), AC.L2-3.1.14: "[a] Identify managed access control points; [b] route remote access through them."NIST SP 800-171A, 3.1.14: "Examine routing configuration through managed points."
You have been hired to assess a contractor's implementation of remote access capabilities for information systems that handle CUI. While interviewing the network administrator, you realize they perform privileged activities remotely when at alternate worksites. Which of the following is the BEST action the contractor can take to address the network administrator's remote execution of privileged activities, as per CMMC practice AC.L2-3.1.15 Privileged Remote Access?
Comprehensive and Detailed In-Depth AC.L2-3.1.15 requires "authorizing and authenticating remote execution of privileged commands using secure methods." MFA (A) ensures strong authentication for privileged remote access, balancing security and operational needs, per CMMC intent. Prohibiting all privileged access (B, D) is overly restrictive and impractical, while logging (C) supports monitoring (AC.L2-3.1.13), not authorization. The guide recommends MFA as best practice.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), AC.L2-3.1.15: "Use MFA to authenticate privileged remote access."NIST SP 800-171A, 3.1.15: "Examine authentication methods like MFA."
During your review of an OSC's system security control, you focus on CMMC practice SC.L2-3.13.9 Connections Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network. The server operating system utilizes default settings for connection timeouts. Network security is managed through a centralfirewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, there is no documented policy or procedure outlining a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work. The scenario describes using a central firewall for network security. How could the firewall be configured to help achieve the objectives of CMMC practice SC.L2-3.13.9 Connections Termination, for the remote access application?
Comprehensive and Detailed In-Depth SC.L2-3.13.9 requires "terminating connections after a defined inactivity period." Firewall rules to terminate inactive CUI application connections (A) directly enforce this, aligning with the practice's intent. Encryption (B) protects transit (SC.L2-3.13.8), IDS/IPS (C) detects threats (SI.L2-3.14.6), and IP blocking (D) limits access (AC.L2-3.1.2)--none address inactivity. The CMMC guide supports firewall- based termination.Extract from Official CMMC Documentation:CMMC Assessment Guide Level 2 (v2.0), SC.L2-3.13.9: "Configure firewalls to terminate inactive connections after a defined period."NIST SP 800-171A, 3.13.9: "Examine firewall rules for inactivity termination."
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.