CMMC-CCA Exam Question 61
A C3PAO has hired a full-time CCA and included them in an Assessment Team sent to conduct a CMMC assessment. However, as part of their agreement with Cyber AB, the CCA and, by extension, the C3PAO are expected to uphold a set of values during the assessment. What document sets the expectations for accredited and credentialed entities authorized to deliver CMMC services under Cyber AB licensing?
CMMC-CCA Exam Question 62
A CCA is part of an Assessment Team conducting a CMMC Level 2 assessment. During an interview, an OSC employee admits that a critical security practice is not implemented because "it's too expensive." The CCA responds by suggesting a low-cost alternative solution to implement the practice. What should the CCA have done instead?
CMMC-CCA Exam Question 63
During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can provide a preliminary score before the assessment is complete to help prioritize remediation efforts. What should the Lead Assessor do?
CMMC-CCA Exam Question 64
When validating an OSC's proposed CMMC assessment scope, the Assessment Team finds that the OSC has properly categorized its assets. The OSC has contracted an External Service Provider (ESP) for various cybersecurity functions. The ESP has deployed FortiSIEM and Splunk for real-time security monitoring, threat intelligence, application monitoring, log management, and reporting. They also deployed Microsoft Intune and configured app protection policies blocking proscribed apps and those suspected of data exfiltration. What type of asset is the ESP?
CMMC-CCA Exam Question 65
You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery. How will proper separation of duties help the contractor meet the intent of AC.L2-3.1.4 - Separation of Duties?