Question 71
You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery. What would you recommend the contractor do to avert the risk?
Question 72
During your assessment of CA.L2-3.12.3 - Security Control Monitoring, the contractor's CISO informs you that they have established a continuous monitoring program to assess the effectiveness of their implemented security controls. When examining their security planning policy, you determine they have a list of automated tools they use to track and report weekly changes in the security controls. The contractor has also established a feedback mechanism that helps them identify areas of improvement in their security controls. Chatting with employees, you understand the contractor regularly invites resource persons to train them on the secure handling of information and identifying gaps in security controls implemented. You would rely on all of the below evidence to assess the contractor's implementation of CA.L2-3.12.3 - Security Control Monitoring, EXCEPT?
Question 73
The OSC has changed its manner of operations in the past year to isolate its manufacturing division (which handles CUI) from its managerial team (which does not). Upon review of the provided information, the Lead Assessor was unable to identify this isolation in the environment. Which step should the Assessor take NEXT to understand how the current documentation isolates the operational components?
Question 74
An OSC seeking Level 2 certification is migrating to a fully cloud-based environment. The organization wants to select a Cloud Service Provider (CSP) that can share responsibilities for CMMC Level 2 requirements. Assume both CSPs can equally provide the technical capabilities and business value required.
* CSP A has SOC 2 certification and is California Consumer Privacy Act (CCPA) and Health Insurance Portability and Accountability Act (HIPAA) compliant.
* CSP B has SOC 2 and FedRAMP Moderate certifications.
Based on this information, which CSP is MOST LIKELY to be acceptable?
* CSP A has SOC 2 certification and is California Consumer Privacy Act (CCPA) and Health Insurance Portability and Accountability Act (HIPAA) compliant.
* CSP B has SOC 2 and FedRAMP Moderate certifications.
Based on this information, which CSP is MOST LIKELY to be acceptable?
Question 75
As the Lead Assessor, you determine that some details, like wireless entry points, are not included in the assessment scope. However, the OSC Assessment Official claims that this is covered in the network enclave.
Examining their enclave architecture, you determine it is not covered, but the OSC Assessment Official insists. What should you do?
Examining their enclave architecture, you determine it is not covered, but the OSC Assessment Official insists. What should you do?