20:00

PDF|

Guide for CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA)

Quiz CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA)

Free Test
/ 10

Quiz

1/10
Topic3,AssessingCMMCLevel2Practices
m
O
c
.
YouareassessingConedgeLtd,acontractorthatdevelopscryptographicalgorithmssforclassified
p
governmentnetworks.Inreviewingtheirnetworkarchitecturedocuments,youseetheyhave
m
implementedrole-basedaccesscontrolsontheirworkstationsusingActiveDirectorygrouppolicies.
Softwaredevelopersareassignedtothe"Dev_Roles"groupwhichgrauntsaccesstocompileandtest
codemodules.The"Admin_Roles"groupwithelevatedprivilegesfdorsystemadministrationactivities
isrestrictedtotheITstaff.However,whenyouexaminetheevmentlogsonadeveloperworkstation,
youfindevidencethatadeveloperwasabletoenabledebuggingpermissionstoaccessprotected
a
kernelmemory–aprivilegedfunction.Howshouldexecutionofthedebuggingpermissionbe
x
handledtoalignwithAC.L2-3.1.7–PrivilegedFunctions?
e
d
A.Requireittogenerateanemailalert
i
l
B.Performautomaticterminationoftheacation
C.Implementgeo-IPblockingontheworvkstation
D.EnsureitisloggedtothecentralSIEM.system
w
w
w
Select the answer
1 correct answer
/
/
:
s
p
ComprehensiveandDetailedIn-DepthExplanation:
t
AC.L2-3.1.7trequires"preventingnon-privilegedusersfromexecutingprivilegedfunctionsand
h
loggingsuchattempts."Thedeveloper’saccesstokernelmemory(aprivilegedfunction)violates
leastprivilege,andloggingtoaSIEM(D)ensuresvisibilityandauditability,aligningwiththepractice.
Alerts(A)aresupplementary,termination(B)isn’trequired,andgeo-IPblocking(C)isunrelated.The
CMMCguideemphasizesloggingforaccountability.
ExtractfromOfficialCMMCDocumentation:
CMMCAssessmentGuideLevel2(v2.0),AC.L2-3.1.7:"Logattemptsbynon-privilegedusersto
executeprivilegedfunctions."
NISTSP800-171A,3.1.7:"Examinelogsforprivilegedfunctionattempts."
Resources:
[https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
6_508.pdf
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-3

Quiz

2/10
Topic3,AssessingCMMCLevel2Practices
m
Whilereviewingacontractor'sMicrosoftActiveDirectoryauthenticationpolicies,youobservethat
theaccountlockoutthresholdisconfiguredtoallow5consecutiveinvalidloginattemptsbefore
lockingtheaccountfor15minutes.Additionally,theresetaccountlockoutcounterissetto30
secondsaftereachunsuccessfulloginattempt.Basedonthisscenario,whichofthefollowing
statementsareTRUEaboutthecontractor'simplementationofCMMCpracticeAC.L2-3.1.8–
UnsuccessfulLogonAttempts?
A.ThecontractorhassuccessfullyimplementedpracticeAC.L2-3.1.8–UnsuccessfulLogonAttempts
warrantingascoreofMET
B.Thecontractor'sapproachdoesnotprovidesufficientprotectionagainstunauthorizedaccess
m
attempts
C.Basedonthecurrentimplementation,CMMCpracticeAC.L2-3.1.8cannotbescoredaosMET
D.Thecontractor'sapproachdoesnotadequatelyaddresstherequiredassessmentobcjectives
.
s
p
Select the answer
1 correct answer
u
ComprehensiveandDetailedIn-DepthExplanation: d
AC.L2-3.1.8requires"limitingunsuccessfullogonattempts"bymdefining:[a]athreshold,and[b]a
lockoutdurationordelay.Thecontractor’ssettings(5attempts,15-minutelockout,30-secondreset)
a
meettheseobjectives,providingreasonableprotectionagainstbrute-forceattacks.Whilestricter
x
settings(e.g.,fewerattempts)couldenhancesecurity,CMMCdoesn’tmandatespecificvalues,only
e
thatlimitsareenforced.This1-pointpracticescoresMet(+1),makingAtrue.B,C,andDassume
d
inadequacywithoutevidenceoffailure.
i
l
ExtractfromOfficialCMMCDocumentation:
a
CMMCAssessmentGuideLevel2(v2.0),vAC.L2-3.1.8:"Defineandenforce[a]numberofattempts,
[b]lockoutdurationordelay." .
w
DoDScoringMethodology:"1-pointpractice:Met=+1."
Resources: w
[https://dodcio.defense.gowv/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gowv/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
6_508.pdf
/
/
:
s

Quiz

3/10
Topic3,AssessingCMMCLevel2Practices
m
P
Whileexaminingacontractor'sauditandaccountabilitypolicy,yourealizetheyhavedocumented
t
typesofevtentstobeloggedanddefinedcontentofauditrecordsneededtosupportmonitoring,
h
analysis,investigation,andreportingofunlawfulorunauthorizedsystemactivities.Afterthelogsare
analyzed,theresultsarefedintoasystemthatautomaticallygeneratesauditrecordsstoredfor30
days.However,mechanismsimplementingsystemauditloggingarelackingafterseveraltests
becausetheyproduceauditlogsthataretoolimited.Youfindthatgeneratedlogscannotbe
independentlyusedtoidentifytheeventtheyresultedfrombecausethedefinedcontentspecified
thereinistoolimited.Additionally,yourealizethelogsareretainedfor24hoursbeforetheyare
automaticallydeleted.WhichofthefollowingisapotentialassessmentmethodforAU.L2-3.3.1–
SystemAuditing?
A.Examineproceduresaddressingauditrecordgeneration
B.Testingproceduresaddressingcontrolofauditrecords
C.Testingthesystemconfigurationsettingsandassociateddocumentation
D.Examiningthemechanismsforimplementingsystemauditlogging
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-4
Select the answer
1 correct answer
ComprehensiveandDetailedIn-DepthExplanation:
AU.L2-3.3.1requires"creatingandretainingauditrecordswithsufficientcontent."Examining
procedures(A)verifiesifdefinedcontentmeetsrequirements,addressingthescenario’sdeficiency
(limitedlogs).Testingprocedures(B)isn’tstandard,testingconfigs(C)issecondary,andexamining
mechanisms(D)isn’tamethod—testingthemis.TheCMMCguidelistsproceduralexaminationas
key.
m
ExtractfromOfficialCMMCDocumentation:
CMMCAssessmentGuideLevel2(v2.0),AU.L2-3.3.1:"Examineproceduresaddressingaouditrecord
generation." c
.
NISTSP800-171A,3.3.1:"Examinedocumentedprocessesforcontentsufficiency."
s
Resources: p
[https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MamsterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MamsterV2.0_FINAL_20211201)
6_508.pdf
u
d

Quiz

4/10
Topic3,AssessingCMMCLevel2Practices
m
M
Youareassessingacontractor’simplementationforCMMCpracticeMA.L2-3.7.4–MediaInspection
a
byexaminingtheirmaintenancerecords.Yourealizethemaintenancelogsidentifyarepeating
x
problem.Arecentlyinstalledcentralserverhasbeenexperiencingissuesaffectingtheperformance
e
ofthecontractor’sinformationsystems.Thisisconfirmedbyyourinterviewwiththecontractor’sIT
d
team.Yourequestedtoinvestigatetheserver,andtheITteamagreed.Ontheserver,thereisafile
i
l
namedconf.zipthatgetsyourattention.Youdecidetoopenthefileinanisolatedcomputerfor
a
furtherreview.Toyoursurprise,thefileivsa.exeusedwhentestingtheserverfordataexfiltration.
Howshouldthisincidentbehandled? .
w
A.ByimmediatelyreportingittotheFBI'sCyberDivision
B.Decommissioningtheservewrandinstallinganewone
C.Inaccordancewiththewincidentresponseplan
D.Bysandboxingthemaliciouscodeandcontinuingwithbusinessasusual
/
/
:
s
Select the answer
1 correct answer
t
t
h
ComprehensiveandDetailedIn-DepthExplanation:
CMMCpracticeMA.L2-3.7.4–MediaInspectionrequiresorganizationsto"inspectmediacontaining
diagnosticandtestprogramspriortomaintenancetoensurenomaliciouscodeispresentandhandle
incidentsappropriately."Thediscoveryofa.exefileusedfordataexfiltrationtestingonaproduction
serverindicatesapotentialsecurityincident(maliciousorunauthorizedcode).Thepractice’sintent
istoidentifyandmanagesuchrisks,andtheCMMCframeworkmandateshandlingincidentsperthe
organization’sincidentresponseplan(IR.L2-3.6.1),whichshouldincludestepslikeverification,
containment,eradication,andreporting.
OptionC:Inaccordancewiththeincidentresponseplan–Thisisthecorrectapproach,asitensuresa
structuredresponse(e.g.,isolatetheserver,investigatethe.exe’sorigin,removeit,andreportif
needed),aligningwithCMMC’sintegratedsecurityprocesses.
OptionA:ReportingtotheFBIimmediately–Prematurewithoutinternalverificationandescalation
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-5
pertheIRplan;externalreportingmayfollowbutisn’tthefirststep.
OptionB:Decommissioningtheserver–Drasticandpotentiallyunnecessarywithoutanalysis;it
disruptsoperationsandskipsinvestigation.
OptionD:Sandboxingandcontinuing–Sandboxingispartofanalysis,butcontinuingbusinessas
usualignorestheriskofactivecompromise.
WhyC?TheCMMCguidetiesmediainspectionincidentstotheIRprocess,ensuringasystematic
responsethatbalancessecurityandoperationalneeds.Theassessor’sroleistoverifycompliance,
notdictateactions,butCreflectstherequiredprocess.
ExtractfromOfficialCMMCDocumentation:
CMMCAssessmentGuideLevel2(v2.0),MA.L2-3.7.4:"Handleidentifiedmaliciouscodein
accordancewithorganizationalincidentresponseprocedures." m
CMMCAssessmentGuideLevel2(v2.0),IR.L2-3.6.1:"Establishanoperationalincident-handling
o
capabilitytoinvestigate,contain,andrecoverfromincidents."
c
NISTSP800-171A,3.7.4:"Examineincidentresponseplansforhandlingmaliciousco.defoundduring
s
mediainspection."
p
Resources:
m
[https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
6_508.pdf u
d
m

Quiz

5/10
Topic3,AssessingCMMCLevel2Practices
m
Acontractorallowsfortheuseofmobiledevicesincontracatperformance.Someemployeesaccess
designsandspecificationsclassifiedasCUIonsuchdevicxesliketabletsandsmartphones.After
e
assessingAC.L2-3.1.18–MobileDeviceConnection,youfindthatthecontractormaintainsa
d
meticulousrecordofmobiledevicesthatconnecttoitsinformationsystems.AC.L2-3.1.19–Encrypt
i
CUIonMobilerequiresthatthecontractorimpllementsmeasurestoencryptCUIonmobiledevices
a
andmobilecomputingplatforms.Thecontractorusesdevice-basedencryptionwhereallthedataon
v
amobiledeviceisencrypted.Whichofthefollowingisareasonwhywouldyourecommend
.
container-basedoverfull-device-bwasedencryption?
A.Container-basedencryptionwoffersgranularcontroloversensitivedata,improvesdevice
performancebyencryptingselectively,andenhancessecurityinBring-Your-Own-Device(BYOD)
w
environments
/
B.Container-basedenc/ryptionismorecost-effective
:
C.Itismoreuser-friendlyandeasiertodeployonalargescale
s
D.Full-deviceepncryptionisnotcompatiblewithmodernmobileoperatingsystems
t
t
Select the answer
1 correct answer
ComprehensiveandDetailedIn-DepthExplanation:
AC.L2-3.1.19requires"encryptingCUIonmobiledevices."Full-deviceencryptionsecuresalldata,
butcontainer-basedencryption(A)offersgranularity(protectingonlyCUI),performance(less
overhead),andBYODcompatibility(separatingwork/personaldata),enhancingsecurityand
usability.Cost(B)andease(C)aren’tprimarydrivers,andfull-deviceencryption(D)iscompatible
withmodernOSes,perCMMCdiscussion.
ExtractfromOfficialCMMCDocumentation:
CMMCAssessmentGuideLevel2(v2.0),AC.L2-3.1.19:"Container-basedencryptionprovides
granularcontrol,performance,andBYODsupport."
NISTSP800-171A,3.1.19:"Assessencryptionmethodsforeffectiveness."
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-6
Resources:
[https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
6_508.pdf

Quiz

6/10
Topic3,AssessingCMMCLevel2Practices
m
DuringyourreviewofanOSC’ssystemsecuritycontrol,youfocusonCMMCpracticeSC.L2-3.13.9–
ConnectionsTermination.TheOSCusesacustomwebapplicationforauthorizedpersonneltoaccess
CUIremotely.Usersloginwithusernamesandpasswords.Theapplicationishostedonadedicated
serverwithinthecompany’sinternalnetwork.Theserveroperatingsystemutilizesdefaultsettings
forconnectiontimeouts.Networksecurityismanagedthroughacentralfirewall,butnospecific
m
rulesareconfiguredforterminatinginactiveconnectionsassociatedwiththeCUIaccessapplication.
Additionally,thereisnodocumentedpolicyorprocedureoutliningadefinedperiodofinoactivityfor
terminatingremoteaccessconnections.InterviewswithITpersonnelrevealthattheycrelysolelyon
.
userstoremembertologoutoftheapplicationaftercompletingtheirwork.Thescenariomentions
s
thattheserverutilizesdefaultsettingsforconnectiontimeouts.Whatadditionpalapproach,besides
relyingsolelyonuserawareness,couldbeimplementedtoachieveconnemctionterminationbasedon
inactivityandcomplywithCMMCpracticeSC.L2-3.13.9–ConnectionsTermination?
u
A.Modifytheserver-sideapplicationsettingstoautomaticallyterminateinactiveusersessionsafter
d
adefinedperiod
m
B.Implementacentralizedinactivitymonitoringtooltoidentifyinactiveconnectionsacrossthe
networkandnotifyadministratorsformanualterminationa
C.Upgradetheserveroperatingsystemtothelatestverxsion,asnewerversionsmayhavestricter
e
defaulttimeoutsforidleconnections
d
D.Educateusersabouttheimportanceofloggingoutandtherisksassociatedwithleavingsessions
i
open l
a
v
Select the answer
1 correct answer
w
ComprehensiveandDetaiwledIn-DepthExplanation:
SC.L2-3.13.9requires"terminatingconnectionsafteradefinedinactivityperiod."Modifying
/
applicationsettingsto/auto-terminatesessions(A)directlyenforcesthis,replacinguserreliancewith
:
atechnicalcontrols,perCMMCintent.Monitoringwithmanualaction(B)isn’tautomatic,OS
p
upgrades(C)don’tguaranteecompliance,andeducation(D)supplements,not
t
replaces,enforcement.
t
ExtracthfromOfficialCMMCDocumentation:
CMMCAssessmentGuideLevel2(v2.0),SC.L2-3.13.9:"Implementauto-terminationatapplication
levelforinactivity."
NISTSP800-171A,3.13.9:"Testapplicationsettingsfortimeoutenforcement."
Resources:
[https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
6_508.pdf

Quiz

7/10
Topic3,AssessingCMMCLevel2Practices
m
Mobiledevicesareincreasinglybecomingimportantinmanycontractors’day-to-dayactivities.Thus,
thecontractorsmustinstitutemeasurestoensuretheyarecorrectlyidentifiedandanyconnections
areauthorized,monitored,andlogged,especiallyifthedevicesortheirconnectionsprocess,store,
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-7
ortransmitCUI.Youhavebeenhiredtoassessacontractor’simplementationofCMMCpractices,
oneofwhichisAC.L2-3.1.18–MobileDeviceConnections.Tosuccessfullytesttheaccesscontrol
capabilitiesauthorizingmobiledeviceconnectionstoorganizationalsystems,youmustfirstidentify
whatamobiledeviceis.Mobiledevicesconnectingtoorganizationalsystemsmusthaveadevice-
specificidentifier.Whichofthefollowingisthemainconsiderationforacontractorwhenchoosing
anidentifier?
A.Choosinganidentifierthatcanaccommodatealldevicesandbeusedconsistentlywithinthe
organization
B.Prioritizeusingidentifiersthatareeasytorememberanduser-friendly
C.Theidentifiermustbeeasilydifferentiablefromonedevicetoanother
D.Userandomidentifierstoidentifymobiledevicesonthenetworkeasily m
o
Select the answer
1 correct answer
s
p
ComprehensiveandDetailedIn-DepthExplanation: m
AC.L2-3.1.18requires"controllingmobiledeviceconnectionswithdevice-specificidentifiers."The
u
mainconsiderationisconsistencyandscalabilityacrossalldevices(A),ensuringuniform
d
managementandauthorization,perCMMCguidance.User-friendliness(B)issecondary,
m
differentiation(C)isabyproductofuniqueness,andrandomness(D)lacksorganizationalcoherence.
ExtractfromOfficialCMMCDocumentation: a
CMMCAssessmentGuideLevel2(v2.0),AC.L2-3.1.18:"xUseconsistent,scalableidentifiersforall
e
mobiledevices."
d
NISTSP800-171A,3.1.18:"Examineidentifierconsistencyacrossdevices."
i
Resources: l
a
[https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
v
6_508.pdf
.
w

Quiz

8/10
Topic3,AssessingCMMCLevel2Practices
m
W
AssessingaDoDcontractowr,youobservetheyhaveimplementedphysicalsecuritymeasuresto
protecttheirfacilityhousingorganizationalsystemsthatprocessorstoreCUI.Thefacilityhassecure
/
locksonallentrances,/exits,andwindows.Additionally,videosurveillancecamerasareinstalledat
:
entry/exitpoints,asndtheirfeedsaremonitoredbysecuritypersonnel.FeedsfromareaswhereCUI
p
isprocessedorstoredandmeetingroomswhereexecutivesmeettodiscussthingsthathavetodo
t
withCUIandothersensitivemattersaresegregatedandstoredonadesignatedserverafter
t
monitohring.Walkingaroundthefacility,younoticenetworkcablesarehangingfromthewalls.To
passthroughadoor,personnelmustswipetheiraccesscards.However,youobserveanemployee
holdingthedoorforotherstoenter.Althoughpowercablesareplacedinwiringclosets,theyaren't
locked,andthecablingconduitsaredamaged.WhichofthefollowingisNOTaconcernregardingthe
contractor'simplementationofCMMCpracticePE.L2-3.10.2–MonitorFacility?
A.Videosurveillancemonitoringatentry/exitpoints
B.Unlockedwiringclosets
C.Networkcableshangingfromthewalls
D.Damagedcableconduits
Select the answer
1 correct answer
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-8
ComprehensiveandDetailedIn-DepthExplanation:
PE.L2-3.10.2requires"protectingandmonitoringthephysicalfacilityandsupportinfrastructure."
Videosurveillanceatentry/exitpoints(A)isastrength,notaconcern,fulfillingmonitoring
requirements.Unlockedwiringclosets(B),exposednetworkcables(C),anddamagedconduits(D)
arevulnerabilitiesriskingtamperingorunauthorizedaccesstoinfrastructuresupportingCUIsystems,
pertheCMMCguide.
ExtractfromOfficialCMMCDocumentation:
CMMCAssessmentGuideLevel2(v2.0),PE.L2-3.10.2:"Monitorfacilitywithcameras;protect
infrastructurefromtampering."
NISTSP800-171A,3.10.2:"Examinemonitoringandprotectionofphysicalassets." m
Resources:
o
[https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
c
6_508.pdf .
s
p

Quiz

9/10
Topic3,AssessingCMMCLevel2Practices
m
M
Wheninterviewingacontractor’sCISO,theyinformyouthattheyhavedocumentedprocedures
u
addressingsecurityassessmentplanningintheirsecurityassessmentandauthorizationpolicy.The
d
policyindicatesthatthecontractorundergoesregularsecurityauditsandpenetrationtestingto
m
assessthepostureofitssecuritycontrolseverytenmonths.Thepolicyalsostatesthatafterevery
fourmonths,thecontractortestsitsincidentresponseplanaandregularlyupdatesitsmonitoring
tools.Impressedbythecontractor’spolicyimplementatixon,youdecidetochatwithvarious
e
personnelinvolvedinsecurityfunctionalities.Yourealizethatalthoughitisdocumentedinthe
d
policy,thecontractorhasnotauditedtheirsecuritysystemsinovertwoyears.Howmanypoints
i
wouldyouscorethecontractor’simplementatilonofthepracticeCA.L2-3.12.1–SecurityControl
a
Assessment?
v
A.-5
.
B.-3 w
C.-1 w
D.5
w
/
/
Select the answer
1 correct answer
s
p
t
ComprehensiveandDetailedIn-DepthExplanation:
t
CA.L2-3h.12.1requires"periodicallyassessingsecuritycontrolstodetermineeffectiveness."The
policydefinesa10-monthcycle,butnoauditshaveoccurredinovertwoyears,failingthe
implementationobjective.PertheDoDScoringMethodology,this5-pointpracticescores-5(Not
Met)whennotfullyimplemented,aspartialcomplianceisn’trecognized.TheCMMCguidestresses
actualexecutionoverdocumentedintent.
ExtractfromOfficialCMMCDocumentation:
CMMCAssessmentGuideLevel2(v2.0),CA.L2-3.12.1:"Assesscontrolsatdefinedfrequency."
DoDScoringMethodology:"5-pointpractice:Met=+5,NotMet=-5."
Resources:
[https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
6_508.pdf
[http://www.justcerts.com](http://www.justcerts.com)
Questions&AnswersPDF P-9

Quiz

10/10
Topic3,AssessingCMMCLevel2Practices
m
Changeisapartofanyproductionprocessandmustbemeticulouslymanaged.SystemChange
ManagementisaCMMCrequirement,andyouhavebeencalledintoassesstheimplementationof
CMMCrequirements.Whenexaminingthecontractor’schangemanagementpolicy,yourealize
thereisadefinedchangeadvisoryboardthathasareviewandapprovalmandateforanyproposed
changes.Thechangeadvisoryboardmaintainsachangerequestsystemwhereallthechangesare
submittedanddocumentedforeasytrackingandreview.Thecontractoralsohasadefinedrollback
plandefiningwhattodoincasetheapprovedchangesresultinunexpectedissuesorvulnerabilities.
Whatevidenceartifactscanthecontractoralsociteasevidencetoshowtheircompliancewith
CM.L2-3.4.3–SystemChangeManagementbesidestheirchangemanagementpolicy?
m
A.Employeesatisfactionsurveysregardingthechangemanagementprocess
B.Systemuptimestatisticsshowingimprovedstabilityafterchangemanagementimplemoentation
C.Organizationalproceduresaddressingsystemconfigurationchangecontrolandchacnge
.
control/auditreviewreports
s
D.Antivirusscanreportsdetailingdetectedandquarantinedthreats p
m
Select the answer
1 correct answer
d
m
ComprehensiveandDetailedIn-DepthExplanation:
a
CM.L2-3.4.3requiresorganizationsto"track,review,approve/disapprove,andlogchangesto
x
organizationalsystems."Beyondthepolicy,evidencelikeproceduresforchangecontrolandreview
e
reportsdirectlydemonstratesimplementation,tracking,andoversight—aligningwiththepractice’s
d
objectives.Surveys(A)anduptimestats(B)areindirectandnotspecifictochangemanagement
i
l
processes,whileantivirusreports(D)areunrelated.TheCMMCguidelistsproceduraldocuments
a
andlogsaskeyartifacts. v
ExtractfromOfficialCMMCDocumenta.tion:
w
CMMCAssessmentGuideLevel2(v2.0),CM.L2-3.4.3:"Examineproceduresaddressingchange
controlandauditreviewreporwts."
NISTSP800-171A,3.4.3:"wArtifactsincludechangecontrolproceduresandlogs."
Resources:
/
[https://dodcio.defense/.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense/.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)
:
6_508.pdf s
p
t
Looking for more questions?Buy now

CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Practice test unlocks all online simulator questions

Thank you for choosing the free version of the CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) practice test! Further deepen your knowledge on Cyber Simulator; by unlocking the full version of our CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Simulator you will be able to take tests with over 318 constantly updated questions and easily pass your exam. 98% of people pass the exam in the first attempt after preparing with our 318 questions.

BUY NOW

What to expect from our CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) practice tests and how to prepare for any exam?

The CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Simulator Practice Tests are part of the Cyber Database and are the best way to prepare for any CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) exam. The CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) practice tests consist of 318 questions and are written by experts to help you and prepare you to pass the exam on the first attempt. The CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) database includes questions from previous and other exams, which means you will be able to practice simulating past and future questions. Preparation with CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Simulator will also give you an idea of the time it will take to complete each section of the CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) practice test . It is important to note that the CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Simulator does not replace the classic CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) study guides; however, the Simulator provides valuable insights into what to expect and how much work needs to be done to prepare for the CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) exam.

BUY NOW

CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Practice test therefore represents an excellent tool to prepare for the actual exam together with our Cyber practice test . Our CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Simulator will help you assess your level of preparation and understand your strengths and weaknesses. Below you can read all the quizzes you will find in our CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Simulator and how our unique CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Database made up of real questions:

Info quiz:

  • Quiz name:CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA)
  • Total number of questions:318
  • Number of questions for the test:50
  • Pass score:80%

You can prepare for the CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) exams with our mobile app. It is very easy to use and even works offline in case of network failure, with all the functions you need to study and practice with our CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Simulator.

Use our Mobile App, available for both Android and iOS devices, with our CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Simulator . You can use it anywhere and always remember that our mobile app is free and available on all stores.

Our Mobile App contains all CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) practice tests which consist of 318 questions and also provide study material to pass the final CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) exam with guaranteed success. Our CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) database contain hundreds of questions and Cyber Tests related to CMMC-CCA: Cyber AB Certified CMMC Assessor (CCA) Exam. This way you can practice anywhere you want, even offline without the internet.

BUY NOW