Question 101
As a Certified CMMC Assessor, you are part of a team assessing a small defense contractor. During the assessment, an employee being interviewed appears unsure about some security practices and asks for your advice on how to answer certain questions to make their compliance appear better. As a Certified CMMC Assessor, what should you do in this situation?
Question 102
During a CMMC assessment, the Lead Assessor requests evidence from the OSC to support their claim that several access control and authentication practices are inherited from their enterprise-level Identity and Access Management (IAM) system. The OSC claims that their parent company manages the IAM system.
Which of the following types of evidence would be the most appropriate for the OSC to demonstrate these inherited practices?
Which of the following types of evidence would be the most appropriate for the OSC to demonstrate these inherited practices?
Question 103
You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment. What is the primary focus of the 'Sufficiency' criterion during the evidence verification process in a CMMC assessment?
Question 104
You are on-site with an Assessment Team at a medium-sized organization. When discussing how they protect their company's information from malware, spyware, etc., the administrator you are interviewing offers to show you the entire process from start to finish since she had that on her to-do list for the day. She opens the machine, turns it on, and installs what she says is anti-malware software. She also demonstrates how their deployed Next Generation Firewall (NGFW) works. You have never heard of this software, so you ask her where it was purchased. You later learn it is an open-source solution. Based on the scenario and the requirements of CMMC practice SI.L2-3.14.6 - Monitor Communications for Attacks, what is your likely determination?
Question 105
Patrick's company was hired to conduct a CMMC Level 2 assessment for Alto Technologies, where his aunt Jane is the VP of Marketing. Patrick did not disclose his relationship to Jane to his employer because he wanted to work on the Assessment Team and did not think Jane was aware of his job. Which of the following was the most appropriate course of action for Patrick?