You are the Lead Assessor for a CMMC Level 2 assessment. The OSC has implemented a practice using a manual process instead of an automated tool, as described in their SSP. The manual process meets the practice's objectives. How should you evaluate this evidence?
Correct Answer: B
Comprehensive and Detailed in Depth Explanation: The CAP requires noting deviations from the SSP as gaps while assessing effectiveness (Option B). Option A ignores documentation, Option C is premature, and Option D is consulting. Extract from Official Document (CAP v1.0): * Section 2.2 - Conduct Assessment (pg. 25):"Document deviations from the SSP as evidence gaps and assess based on actual implementation." References: CMMC Assessment Process (CAP) v1.0, Section 2.2.
CMMC-CCA Exam Question 152
Part of effective CUI protection involves knowing which assets process, transmit, or store CUI. This understanding is crucial for defining CUI boundaries within an OSC's systems. To achieve this, an OSC can prepare a logical data flow diagram for their information systems. Which of the following questions does a logical data flow diagram not answer?
Correct Answer: B
Comprehensive and Detailed in Depth Explanation: A logical data flow diagram, per CMMC Level 2, maps CUI flow, answering what data moves (Option C), who/what receives it (Option D), and how it's received (Option A). It doesn't detail physical implementation (Option B), which is a physical diagram's role. Option B is the correct answer. Reference Extract: * CMMC AG Level 2, Section 1.3:"Logical data flow diagrams focus on data movement, not system implementation."Resources:https://dodcio.defense.gov/Portals/0/Documents/CMMC /AG_Level2_MasterV2.0_FINAL_202112016_508.pdf
CMMC-CCA Exam Question 153
An OSC can use either of the following strategies to meet the requirements of CMMC practice MP.L2-3.8.8 - Shared Media, EXCEPT?
Correct Answer: A
Comprehensive and Detailed In-Depth Explanation: MP.L2-3.8.8 - Shared Media requires organizations to "prohibit the use of portable storage devices containing CUI when such devices have no identifiable owner." Options B, C, and D enforce ownership and control (labeling, registration, policy), aligning with the practice. Permitting unrestricted use after training (A) fails to ensure ownership, violating the practice's intent, even with awareness training. The CMMC guide mandates identifiable ownership, not just training. Extract from Official CMMC Documentation: * CMMC Assessment Guide Level 2 (v2.0), MP.L2-3.8.8: "Prohibit use of portable devices without identifiable owners; training alone insufficient." * NIST SP 800-171A, 3.8.8: "Examine controls ensuring device ownership." Resources: * https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2. 0_FINAL_202112016_508.pdf
