Question 106
During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on the OSC's procedures around configuration management and endpoint security. The system administrator described how they build and deploy new systems, and noted that some users require specialized applications for their jobs. Users have been asked to email IT when they install and run an additional application so IT can add it to their list of allowed software.
What must the CCA conclude?
What must the CCA conclude?
Question 107
Prior to starting an assessment, an OSC must develop a data flow diagram. This diagram can then be used as a tool to help establish the context and boundaries of the CMMC assessment activities. What is critical to capture while developing the data flow diagram?
Question 108
An OSC plans to bid for a DoD contract to supply laser welding services to repair a fleet of unmanned aerial vehicles (UAVs). This requires them to be CMMC Level 2 certified since the information they will receive from the DoD is Controlled Technical Information (CTI). However,their repair and welding services require a Computer Numerical Control (CNC) machine to fabricate some crucial parts. Since the welding is mainly automated using robots, the OSC has intelligently integrated its SCADA system with Programmable Logic Controllers (PLCs) for increased accuracy, improved safety and efficiency, and enhanced flexibility. As the Lead Assessor for the C3PAO Assessment Team validating the OSC's CMMC assessment scope, you expect the OSC to handle the SCADA system, PLCs, and CNC machines in all the following ways EXCEPT?
Question 109
A CCA is assessing an OSC that uses a complex multi-cloud architecture with resources distributed across multiple Cloud Service Providers (CSPs). During the evaluation, the CCA encounters challenges in verifying the authorization methods used for external connections to the various cloud resources (AC.L1-3.1.20).
Additionally, the assessor finds limited documentation of the cryptographic mechanisms implemented to protect the confidentiality of remote access sessions (AC.L2-3.1.13) to cloud-based data. While the OSC has network monitoring tools in place, the sheer volume of data makes it difficult to identify and track specific remote access activities. What challenges might the CCA face while assessing the OSC's cloud and hybrid environment for compliance with CMMC remote access requirements?
Additionally, the assessor finds limited documentation of the cryptographic mechanisms implemented to protect the confidentiality of remote access sessions (AC.L2-3.1.13) to cloud-based data. While the OSC has network monitoring tools in place, the sheer volume of data makes it difficult to identify and track specific remote access activities. What challenges might the CCA face while assessing the OSC's cloud and hybrid environment for compliance with CMMC remote access requirements?
Question 110
As a Lead Assessor, you are in contact with the OSC Assessment Official. The Assessment Official has submitted a document that outlines the scope of your assessment engagement. You expect to find all the following elements on the Assessment Scope document, EXCEPT?