CMMC-CCA

An Organization Seeking Certification (OSC) has submitted their self-assessment results showing all 110 NIST SP 800-171 practices as "MET." As a CCA, what is your primary concern before beginning the formal assessment?

• AThe OSC used an automated scanning tool instead of manual review
• BA self-assessment showing all practices as MET without any deficiencies is statistically…
• CThe OSC did not hire a certified consultant to perform the self-assessment
• DThe self-assessment must be performed by a CCA, not the organization itself

During a pre-assessment review, an OSC provides System Security Plan (SSP) documentation dated three years ago with no subsequent updates. What determination should the CCA make regarding AC.L2-3.1.1 (Access Control Policy)?

• ANOT MET because the SSP is outdated and does not reflect current system environment
• BMET because the SSP exists and covers access control requirements
• CNOT APPLICABLE because the SSP was created before CMMC requirements were finalized
• DMET with deficiencies because the policy exists but needs updating

An OSC has provided evidence for IA.L2-3.5.6 (Identifier Handling) showing their identity management system automatically disables accounts after 90 days of inactivity. The System Security Plan (SSP) defines the inactivity disablement period as 35 days. What is the appropriate finding?

• AMET because 90 days is within industry standard
• BNOT MET because identifiers are not disabled after the organization-defined period of ina…
• CNOT MET because NIST SP 800-171 mandates a universal 30-day inactivity disablement period
• DMET if the organization can demonstrate risk acceptance for the 90-day period without upd…

During an assessment, the OSC provides audit logs showing successful authentication events but cannot produce logs for failed authentication attempts. The OSC claims their SIEM solution only captures successful logons due to storage constraints. What is the correct determination for AU.L2-3.3.1 (Audit Events)?

• AMET because the OSC has audit logging implemented and documented their justification
• BNOT MET because AU.L2-3.3.1 specifically requires auditing of failed logon attempts
• CNOT APPLICABLE because storage constraints are a legitimate technical limitation
• DMET with POAM because the control is partially implemented

Before conducting a CMMC Level 2 assessment, what document must the CCA verify exists and is current?

• AA fully executed Department of Defense contract
• BA valid CMMC Level 1 certificate
• CA System Security Plan (SSP) that addresses all 110 NIST SP 800-171 security requirements
• DA third-party penetration test report dated within 30 days

An OSC informs the assessment team that their previous C3PAO assessment found three practices NOT MET, which they addressed through a POAM. The OSC completed the POAM items and is now requesting reassessment. What must the CCA verify?

• AOnly that the POAM items were marked complete by the OSC
• BThat the POAM items were completed AND objective evidence exists demonstrating full imple…
• CThat the OSC paid all fees associated with the previous assessment
• DThat the previous C3PAO agrees the POAM is complete

During evidence review, a CCA discovers that an OSC's network diagram shows connections to a subcontractor's environment that processes CUI, but the OSC's SSP makes no mention of this external connection. The OSC claims the subcontractor handles all security for their portion. What is the appropriate assessment action?

• AAccept the OSC's explanation as the subcontractor is responsible for their own security
• BMark SC.L2-3.13.1 (Boundary Protection) as MET since the connection is documented in the…
• CRequest the OSC update the SSP to include the external connection and conduct further rev…
• DImmediately terminate the assessment as the OSC is not in compliance

An OSC presents evidence for CM.L2-3.4.1 (Baseline Configuration) showing configuration baselines established two years ago. When asked about change history, the OSC admits they have not updated baselines since initial creation despite numerous system changes. What is the appropriate finding?

• AMET because baselines were established as required
• BNOT MET because CM.L2-3.4.1 requires maintaining and updating baseline configurations
• CNOT APPLICABLE because the systems are stable and do not require frequent baseline updates
• DMET with POAM because the baselines exist but need refreshing

Which of the following assets would be categorized as a CUI Asset in a CMMC Level 2 assessment scope?

• AThe corporate public website server
• BA workstation used by an employee to process CUI from a DoD contract
• CThe network firewall protecting the corporate infrastructure
• DA standalone air-gapped test environment with no CUI

During scoping activities, a CCA identifies an outsourced IT provider that manages the OSC's email system which contains CUI. The provider has not achieved CMMC Level 2 certification. What impact does this have on the assessment scope?

• AThe OSC must immediately terminate the contract with the IT provider
• BThe IT provider's environment becomes part of the assessment scope and must be assessed
• CThe OSC cannot achieve CMMC Level 2 certification with an uncertified service provider
• DThe CCA must exclude the email system from the scope and document the limitation

An OSC operates multiple facilities. Facility A processes CUI for DoD contracts. Facility B handles only commercial work with no CUI. Facility C processes CUI for a different federal agency (not DoD). Facility D provides IT support to all other facilities and has access to CUI from Facility A. Which facilities are in scope for the CMMC assessment?

• AOnly Facility A
• BFacilities A and D
• CFacilities A, C, and D
• DAll four facilities

A CCA is reviewing an OSC's network diagram and notices a direct connection between the CUI environment and the corporate guest Wi-Fi network. The OSC states this connection is protected by a firewall. How should this be addressed during scoping?

• AAccept the firewall as adequate protection and include only the CUI environment in scope
• BExclude the guest Wi-Fi as it is not part of the CUI processing environment
• CInclude the guest Wi-Fi network in scope and assess the effectiveness of the boundary pro…
• DRecommend the OSC remove the connection before proceeding with assessment

Which of the following would be classified as a Security Protection Asset (SPA)?

• AA database server storing CUI for a DoD contract
• BAn employee's laptop used to create CUI documents
• CA network firewall controlling traffic to the CUI environment
• DA standalone development server with no CUI access

An OSC uses a cloud-based Software-as-a-Service (SaaS) solution for document collaboration. The SaaS provider stores data in shared infrastructure where the OSC's CUI could be commingled with other customers' data. The SaaS provider is not FedRAMP authorized. What is the impact on the CMMC assessment?

• AThe SaaS solution must be excluded from scope as it cannot meet CMMC requirements
• BThe SaaS environment is in scope and the CCA must assess the CSP against all 110 NIST SP…
• CThe SaaS solution can be treated as Out-of-Scope if the OSC encrypts all CUI
• DThe OSC must use a FedRAMP Moderate (or higher) authorized or equivalent cloud offering f…

During data flow analysis, a CCA identifies that CUI is being transferred to a subcontractor via encrypted email. The OSC maintains that the subcontractor has signed a contract agreeing to protect the CUI. What additional verification is required?

• ANo additional verification is needed as the contract is sufficient
• BThe CCA must verify the subcontractor has achieved CMMC Level 2 certification or assess t…
• CThe transfer method must be changed to physical media only
• DThe subcontractor must sign a new NDA specific to CMMC requirements

An OSC has an asset inventory listing 500 endpoints. During the assessment kickoff meeting, the IT director mentions they recently deployed 50 new laptops that have not yet been added to the inventory. How should the CCA proceed?

• AProceed with the assessment using the existing inventory of 500 endpoints
• BRequest the OSC update the asset inventory to include all 550 endpoints before proceeding
• CExclude the 50 new laptops from scope as they are not yet in production
• DInclude only the 50 new laptops in scope as they represent the current state

Which statement about Specialized Assets is correct?

• ASpecialized Assets are out of scope and do not require any security controls
• BSpecialized Assets are government-furnished equipment that the OSC does not control
• CSpecialized Assets are systems that cannot meet all CMMC requirements due to technical li…
• DSpecialized Assets are only found in classified environments

An OSC operates in a multi-tenant office building where the building management provides shared network infrastructure and physical security. The OSC's CUI environment uses this shared infrastructure. How should the CCA handle this during scoping?

• AExclude the shared infrastructure as the OSC does not control it
• BInclude the building's shared infrastructure in scope and assess it against all 110 pract…
• CAssess the OSC's implementation of the shared infrastructure and document dependencies
• DRecommend the OSC relocate to a dedicated facility before certification

What is the minimum required composition of a CMMC Level 2 assessment team led by a CCA?

• AAt least one CCA and one CCP
• BA Lead CCA and at least one other CCA
• CA single CCA serving as Lead Assessor with no additional CCA required
• DAt least one CCA and one individual with CISSP certification

During the assessment planning phase, the OSC requests that certain documentation be reviewed remotely rather than on-site. As the Lead Assessor, how should this request be handled?

• AAccept the request as it improves assessment efficiency
• BReject the request as CMMC requires all assessment activities to be conducted on-site
• CEvaluate whether remote review would compromise the assessment's ability to verify practi…
• DSubmit the request to the Cyber AB for approval

A CCA is assessing IR.L2-3.6.2 (Incident Reporting) and requests to review incident reports from the past year. The OSC provides three reports and states they have had no other security incidents. However, the OSC's SIEM logs show multiple alerts that appear to be security events. What should the CCA do?

• AAccept the OSC's statement as accurate and mark the practice MET
• BMark the practice NOT MET based on the discrepancy between reports and SIEM logs
• CRequest additional information about the SIEM alerts and the OSC's incident determination…
• DExclude IR.L2-3.6.2 from scope due to conflicting evidence

What constitutes "objective evidence" for the purpose of CMMC assessment?

• AAny documentation provided by the OSC
• BObservable, verifiable data that demonstrates implementation of a practice without bias o…
• CThe CCA's professional opinion based on experience
• DTestimonials from OSC employees about security practices

When can a practice be marked as "NOT APPLICABLE" (N/A) during a CMMC Level 2 assessment?

• AWhen the OSC believes the practice does not apply to their environment
• BWhen the practice is implemented by a third party on behalf of the OSC
• CWhen the practice addresses a requirement that is not relevant to the OSC's specific syst…
• DWhen the OSC has a POAM to implement the practice in the future

During assessment of CA.L2-3.12.1 (Security Assessments), the CCA reviews the OSC's most recent security assessment report. The report was conducted internally by the IT team six months ago and contains only a checklist of practices with checkmarks. What finding is most appropriate?

• AMET because an assessment was conducted within the past year
• BNOT MET because the assessment lacks the depth and independence required by the practice
• CNOT APPLICABLE because the OSC is currently undergoing a CMMC assessment
• DMET with POAM because the assessment exists but should be more comprehensive

An OSC has been assessed and found to have five practices rated as NOT MET. The OSC intends to submit a POAM for these deficiencies. What is the maximum timeframe allowed for closing POAM items for CMMC Level 2?

• A30 days from the date of assessment
• B90 days from the date of assessment
• C180 days from the date of assessment
• DPOAM timeframes are at the discretion of the C3PAO

How do CMMC Level 2 (C3PAO) certification assessment results become visible in SPRS?

• AThe OSC manually updates the SPRS assessment score within 30 days using C3PAO paperwork
• BThe C3PAO submits assessment results into the CMMC instantiation of eMASS, which automati…
• CCyber AB manually enters the score into SPRS after reviewing the Assessment Report
• DSPRS is updated only when the OSC submits its annual affirmation, not after the assessment

What is the primary purpose of the Assessment Plan in the CMMC Assessment Process (CAP)?

• ATo document the final assessment results for submission to Cyber AB
• BTo establish the scope, schedule, resources, and approach for the assessment
• CTo list all employees who will participate in the assessment
• DTo record all NOT MET findings and required POAMs

During the assessment, the OSC's IT director refuses to provide access to certain system logs, citing concerns about revealing sensitive system architecture details. The CCA needs these logs to verify AU.L2-3.3.2 (Audit Review). What is the appropriate course of action?

• AMark AU.L2-3.3.2 as NOT MET due to lack of evidence and proceed
• BAccept the OSC's concern and use alternative evidence such as interviews
• CExplain the requirement for objective evidence and request the OSC provide the logs or ag…
• DImmediately suspend the assessment and report the issue to Cyber AB

A CCA is conducting the final findings review and discovers that one practice originally marked as MET should actually be NOT MET due to additional information revealed during the assessment. What is the correct procedure?

• AKeep the original MET determination to maintain assessment consistency
• BChange the finding to NOT MET and document the rationale based on the objective evidence
• CMark the practice as NOT APPLICABLE to avoid affecting the final score
• DRequest the OSC provide additional evidence after the assessment to support MET

Which of the following would be considered a conflict of interest that disqualifies a CCA from conducting an assessment?

• AThe CCA previously worked for the same company as the OSC's IT director
• BThe CCA was employed by the OSC as a consultant to help prepare for CMMC assessment withi…
• CThe CCA and OSC's CISO attended the same university
• DThe CCA has assessed similar companies in the same industry

What must the C3PAO submit to the Cyber AB following a CMMC Level 2 assessment?

• AOnly the final score and certification decision
• BThe Assessment Report including findings, evidence summary, and certification recommendat…
• CIndividual practice scores for all 110 practices with detailed evidence
• DOnly the list of NOT MET practices and associated POAMs

An OSC implements role-based access control where users are assigned to groups that determine their system access. However, the OSC cannot demonstrate that access permissions are reviewed on a periodic basis. What is the appropriate finding for AC.L2-3.1.4 (Access Enforcement)?

• AMET because role-based access control is implemented
• BNOT MET because AC.L2-3.1.4 requires both enforcement and periodic review of access
• CNOT APPLICABLE because the control is addressed by AC.L2-3.1.5 (Least Privilege)
• DMET with POAM because the enforcement mechanism exists but review is needed

Which of the following satisfies AC.L2-3.1.20 (External Connections)?

• ADocumenting all external connections in the network diagram
• BMonitoring external connections with a SIEM
• CEstablishing terms and conditions for external connections and documenting each connection
• DRequiring VPN for all external connections

An OSC provides annual security awareness training to all employees and role-based training for IT staff. A contractor who was hired three months ago has not received any security training. How should AT.L2-3.2.1 (Awareness and Training Policy) be assessed?

• AMET because the OSC provides required training to employees and IT staff
• BNOT MET because contractors are not receiving the required security training
• CNOT APPLICABLE because the contractor is not an employee
• DMET with POAM because the training program exists but needs to cover contractors

An OSC's audit logs are stored on the same server where the audited activities occur. The OSC states they have backup procedures in place. During assessment of AU.L2-3.3.4 (Audit Storage), what concern should the CCA raise?

• AThere is no concern if backups are performed regularly
• BThe audit logs may be compromised if the server is breached, violating the protection req…
• CAudit logs should never be stored on the server being audited
• DThe backup procedures must be tested daily

Which of the following demonstrates compliance with CM.L2-3.4.2 (Baseline Configuration)?

• AMaintaining a spreadsheet listing all approved software
• BDocumenting the standard configuration for each system type and implementing it consisten…
• CUsing Group Policy to deploy settings to Windows systems
• DHaving a change control board that approves all changes

An OSC requires passwords of at least 12 characters and complexity including uppercase, lowercase, and numbers. Passwords must be changed every 90 days. Does this meet IA.L2-3.5.7 (Password Complexity)?

• AYes, because the password length and complexity requirements exceed NIST recommendations
• BNo, because NIST SP 800-171 requires passwords to be changed every 60 days
• CNo, because NIST SP 800-171B prohibits periodic password changes
• DThe CCA must verify the implementation aligns with current NIST guidance on authenticator…

An OSC has an incident response plan that includes procedures for containment, eradication, and recovery. However, the plan does not define criteria for prioritizing incidents based on impact or specify reporting requirements to DoD for CUI incidents. What is the finding for IR.L2-3.6.1 (Incident Response Policy)?

• AMET because the plan addresses the core incident response functions
• BNOT MET because the plan is incomplete regarding incident prioritization and DoD reporting
• CNOT APPLICABLE because incident prioritization is addressed in risk management
• DMET with POAM because the plan exists but needs enhancement

Which action demonstrates compliance with MA.L2-3.7.3 (Equipment Maintenance)?

• APerforming preventive maintenance on network equipment according to manufacturer schedules
• BDocumenting all equipment purchases
• CHaving a help desk to respond to equipment failures
• DReplacing equipment when it fails

An OSC has a procedure for sanitizing hard drives before disposal using a single overwrite pass. They document each sanitization. What is the finding for MP.L2-3.8.6 (Media Sanitization)?

• AMET because the OSC has a documented sanitization procedure
• BNOT MET because NIST SP 800-171 requires at least three overwrite passes
• CMET if the drives are encrypted, NOT MET otherwise
• DThe CCA must verify the sanitization method meets NIST SP 800-88 requirements

An OSC conducts background checks for all new hires but does not have a procedure for screening personnel when they are transferred to positions with CUI access. How should PS.L2-3.9.2 (Personnel Screening) be assessed?

• AMET because background checks are conducted for all new hires
• BNOT MET because the practice requires screening when personnel are assigned to privileged…
• CNOT APPLICABLE because transfers are not new hires
• DMET with POAM because the screening program exists but needs to address transfers

Which of the following satisfies PE.L2-3.10.3 (Physical Access Control)?

• APosting security guards at the building entrance
• BRequiring badge access for entry to areas where CUI is processed
• CHaving a sign-in sheet for visitors
• DInstalling security cameras throughout the facility

An OSC conducted a comprehensive risk assessment two years ago that covered all NIST SP 800-171 requirements. Since then, they have migrated significant systems to cloud services and acquired another company. The OSC has not updated the risk assessment. What is the finding for RA.L2-3.11.1 (Risk Assessments)?

• AMET because the risk assessment covered all requirements
• BNOT MET because the risk assessment is outdated relative to the current environment
• CNOT APPLICABLE because vulnerability scanning is a technical control, not a documentation…
• DMET with POAM because the assessment exists but needs updating

An OSC conducts annual vulnerability scans using an automated tool and remediates critical findings within 30 days. They do not perform penetration testing. What is the finding for RA.L2-3.11.2 (Vulnerability Scanning)?

• AMET because vulnerability scans are conducted and findings are remediated
• BNOT MET because penetration testing is required
• CNOT MET because vulnerability remediation should occur within 7 days
• DMET with POAM because penetration testing should be added

Which implementation satisfies SC.L2-3.13.1 (Boundary Protection)?

• AInstalling antivirus software on all endpoints
• BImplementing firewalls at network boundaries and configuring default-deny rules
• CEncrypting all data at rest
• DUsing multi-factor authentication for remote access

An OSC uses TLS 1.0 for encrypting data in transit between their web application and users. They state that upgrading to TLS 1.2 or 1.3 would require significant application modifications. How should SC.L2-3.13.8 (Transmission Confidentiality) be assessed?

• AMET because encryption is implemented for data in transit
• BNOT MET because TLS 1.0 has known vulnerabilities and does not provide adequate protection
• CNOT APPLICABLE because the cost of upgrade is prohibitive
• DMET with POAM because encryption exists but needs upgrading

An OSC has antivirus software installed on all systems and receives daily signature updates. However, the OSC does not have procedures for responding to malicious code detections. What is the finding for SI.L2-3.14.2 (Malicious Code Protection)?

• AMET because antivirus is implemented and updated
• BNOT MET because SI.L2-3.14.2 requires both detection and response capabilities
• CNOT APPLICABLE because SI.L2-3.14.4 (Update Malicious Code Protection) addresses procedur…
• DMET with POAM because the detection capability exists but response procedures are needed