Question 116
An aerospace company has requested a CMMC assessment for an enclave only. Your team has verified that the company has a valid CAGE code and is registered with SAM.gov. However, the enclave has no separate CAGE code or SAM registration. Can the assessor proceed with the CMMC assessment solely for the enclave, or is an assessment of the entire aerospace company's network required?
Question 117
An OSC has two business locations. At each location, the OSC has a wireless guest network to which non- OSC employees are allowed access. The guest network is not password protected and it connects devices within the local OSC's LAN. Based on this information, does the OSC meet the requirements of Level 2 for network access restriction?
Question 118
As part of a C3PAO Assessment Team, you are reviewing an OSC's security practices and documentation.
During your review, you notice that the OSC has presented the same evidence artifacts to support its implementation of several CMMC practices and objectives. Based on the scenario above and your understanding of the CMMC Assessment process, which of the following is true?
During your review, you notice that the OSC has presented the same evidence artifacts to support its implementation of several CMMC practices and objectives. Based on the scenario above and your understanding of the CMMC Assessment process, which of the following is true?
Question 119
During a CMMC assessment, you, as a CCA, are interviewing a key OSC employee with information security responsibilities about the access control procedures. As the interview progresses, you realize that the initial information provided in the System Security Plan (SSP) doesn't fully align with the employee's explanation.
Based on the scenario and your role as a CCA, what is not one of your responsibilities as an assessment team member?
Based on the scenario and your role as a CCA, what is not one of your responsibilities as an assessment team member?
Question 120
You are evaluating an OSC for compliance with CMMC Level 2 practices. During your assessment of SC controls, you use a series of assessment methods to understand how effectively the OSC has implemented them. The OSC has a documented security policy outlining user roles and responsibilities. The OSC's system and communications protection policy states that basic user and privileged functionalities are separated. They have deployed Azure AD to help enforce this requirement through identity management. Interviews with system administrators reveal they have elevated privileges for system management tasks. A review of system configuration settings shows separate user accounts for standard users and administrators. However, you notice that some employees use personal cloud storage services for storing work documents. Considering CMMC practice SC.L2-3.13.4 - Shared Resource Control, which of the following actions would be most effective in addressing the identified risk?