Cyber AB CMMC-CCA Answers

You are assessing a contractor that develops missile guidance software containing CUI data. The software developers have administrative privileges on their workstations to be able to install tools and edit configuration files needed for their jobs. However, you have noted that many of the developers have access to modify components critical to system security, which is beyond what is needed for their specific roles. Which of the following would be a way to implement AC.L2-3.1.5, Least Privilege in this situation?

During an interview with network administrators responsible for managing remote access, they mentioned using a next-generation firewall (NGFW) to secure the VPN connection, which can inspect remote device configurations and identify signs of potential split tunneling. How can the functionality of this NGFW contribute to achieving the objectives of CMMC practice SC.L2-3.13.7-Split Tunneling?

You are a CCA working for a C3PAO. An OSC has submitted a request for a CMMC Assessment, and the C3PAO is in the process of assigning a Lead Assessor for this engagement. As an experienced Assessor, you are being considered for the role of Lead Assessor. Once the C3PAO assigns the Lead Assessor, what is the next step in the process?

You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC?s POC schedule a joint review session to align on the scope and expectations for the upcoming assessment. Why is it important for the Lead Assessor and the OSC's POC to review the OSC's self-assessment findings before the formal CMMC assessment begins?

Pre-assessment information must be uploaded to CMMC eMASS by the end of the planning phase (Phase 1). Who uploads this information and what happens if the pre-assessment information changes after the upload?