You are the Lead Assessor for a CMMC Level 2 assessment. The OSC has implemented a practice using a manual process instead of an automated tool, as described in their SSP. The manual process meets the practice's objectives. How should you evaluate this evidence?
Correct Answer: B
Comprehensive and Detailed in Depth Explanation: The CAP requires noting deviations from the SSP as gaps while assessing effectiveness (Option B). Option A ignores documentation, Option C is premature, and Option D is consulting. Extract from Official Document (CAP v1.0): * Section 2.2 - Conduct Assessment (pg. 25):"Document deviations from the SSP as evidence gaps and assess based on actual implementation." References: CMMC Assessment Process (CAP) v1.0, Section 2.2.
Question 77
An OSC is presenting the CMMC Assessment to the C3PAO along with all supporting documentation. The supporting documents include drawings from a patent application that has not been filed with the patent office and are marked as attorney-client privileged. What document is recommended that the OSC and C3PAO sign?
Correct Answer: C
The CMMC Assessment Process (CAP) requires that when sensitive or proprietary materials are exchanged during an assessment, the OSC and the C3PAO should establish confidentiality protections through a Non- Disclosure Agreement (NDA). Extract: "OSC and C3PAOs are expected to execute a Non-Disclosure Agreement (NDA) to protect sensitive information such as proprietary, attorney-client privileged, or pre-patent materials shared during the assessment process." Thus, the NDA is the correct document. Reference: CMMC Assessment Process (CAP), Confidentiality Provisions.
Question 78
During an assessment interview, the interviewee states that anyone can connect to the company Wi-Fi without prior approval. Within which domains is the Wi-Fi configuration covered?
Correct Answer: C
* Access Control (AC): Wi-Fi access must be restricted to authorized users and devices. CMMC Level 2 incorporates NIST SP 800-171 AC requirements to limit and control access to systems and resources. * Identification and Authentication (IA): Wireless access requires authentication to ensure only authorized individuals/devices can connect (e.g., WPA2-Enterprise, certificates, or strong passwords). * System and Communications Protection (SC): Wi-Fi encryption and secure configuration protect data-in-transit from interception or unauthorized disclosure. Why Other Options Are Incorrect: * A (MP, AC, PE): Media protection and physical protection are not primary domains for Wi-Fi configuration. * B (IA, MP, SI): Media protection and system/information integrity do not directly address Wi-Fi security. * D (SC, SI, PE): Physical and integrity controls are not central to wireless access security. References (CCA Official Sources): * CMMC Model v2.0 - Domains AC, IA, SC * NIST SP 800-171 Rev. 2 - AC.L2-3.1.1, IA.L2-3.5.3, SC.L2-3.13.8 (wireless access, identification /authentication, protection of communications) * NIST SP 800-171A - Associated assessment objectives verifying Wi-Fi control and encryption
Question 79
A company is undergoing a CMMC Level 2 Assessment. The Assessment Team is planning and preparing the assessment. Who is responsible for identifying methods, techniques, and responsibilities for collecting, managing, and reviewing evidence?
Correct Answer: A
The Lead Assessor is responsible for managing the assessment team and planning the assessment, including defining the methods, techniques, and responsibilities for collecting, managing, and reviewing evidence. Team members execute assigned tasks, but the Lead Assessor provides direction and oversight. Exact Extracts: * CMMC Assessment Guide: "The Lead Assessor is responsible for the management of the assessment, including defining evidence collection methods, techniques, and responsibilities." * "The assessment team members carry out activities as directed by the Lead Assessor." * "The C3PAO Quality Oversight and CMMC Quality Assurance are post-assessment quality functions, not evidence planning functions." Why other options are not correct: * B: Team members execute tasks but do not define methods and responsibilities. * C: Quality Oversight Managers review assessments after completion, not during planning. * D: CMMC Quality Assurance Professionals conduct QA on assessments, not evidence planning. References: CMMC Assessment Guide - Level 2, Version 2.13: Assessment planning roles and responsibilities (pp. 4-6).
Question 80
After you ask to examine some audit records, the contractor's system administrator informs you that there is a process to follow before accessing them. The logs are hashed using SHA-512 algorithms, and the system administrator has to run an algorithm to recalculate the hashes for the audit records to verify their integrity before running a decryption algorithm to decrypt the data. Since this might take some time, you tour the facility while interviewing personnel with audit and accountability roles. You see an employee holding the door for another without using their physical access card. While interviewing the contractor's employees, you find that they can access all audit logging tools and tweak the settings according to their needs or requirements. Upon examining the contractor's access control policy, you realize they have not defined the measures to protect audit logging tools. Which of the following statements accurately describes the contractor's compliance with protecting audit logging tools from unauthorized access, modification, and deletion, as required by AU.L2-3.3.8 - Audit Protection?
Correct Answer: D
Comprehensive and Detailed In-Depth Explanation: AU.L2-3.3.8 requires "protecting audit information and tools from unauthorized access, modification, and deletion." The lack of defined measures and unrestricted employee access to tweak settings violate this, scoring Not Met (-1) for this 1-point practice. A is false given clear evidence, B assumes protection not shown, and C misinterprets compliance. Extract from Official CMMC Documentation: * CMMC Assessment Guide Level 2 (v2.0), AU.L2-3.3.8: "Protect audit tools with defined access controls; unrestricted access is non-compliant." * DoD Scoring Methodology: "1-point practice: Met = +1, Not Met = -1." Resources: * https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2. 0_FINAL_202112016_508.pdf
