Free CMMC-CCA Mock Exam – Practice Online Confidently

An OSC is planning a CMMC Level 2 assessment that your C3PAO will conduct. In Phase 1.6.1-Access and Verify Evidence, as the Lead Assessor, you are verifying the existence and accessibility of the evidence provided by the OSC. While reviewing the list of evidence mapped against the CMMC practices, you discover that the OSC cannot locate several critical system security policies for key IT systems supporting their DoD contracts. These missing policies are essential for demonstrating compliance with various CMMC practices related to access control, incident response, and system maintenance. According to the CMMC Assessment Process (CAP), which of the following is not permitted for the Lead Assessor to do during the evidence verification stage?

During the Awareness and Training (AT) domain assessment, you examine the company's security awareness and training program. All new hires undergo a one-time security awareness training session during their onboarding process. After that, the IT department sends periodic email reminders about general security best practices, such as password management and phishing awareness. The contractor also offers an annual refresher training for managers and supervisors, covering topics related to data protection and incident response procedures. However, chatting with personnel from different roles, you discover personnel responsible for managing the company's networks and systems have yet to receive any specific training on secure configuration practices or identifying potential security risks associated with their roles. Production line workers and technicians handling CUI data during the manufacturing process are unaware of the specific security risks or procedures for handling and protecting CUI. Which of the following techniques can the contractor use to attain compliance with AT.L2-3.2.1-Role-Based Risk Awareness?

During an interview with network administrators responsible for managing remote access, they mentioned using a next-generation firewall (NGFW) to secure the VPN connection, which can inspect remote device configurations and identify signs of potential split tunneling. How can the functionality of this NGFW contribute to achieving the objectives of CMMC practice SC.L2-3.13.7-Split Tunneling?

An OSC uses a third party in all system repairs and has hired an MSP for penetration testing. The third party comes for either adaptive, preventative, perfective, or corrective system maintenance every three months, and the penetration tester does so continuously. Whenever the third party comes for maintenance, there's no documentation of the issues they tackled. On the other hand, the penetration tester delivers meticulously detailed documentation per their contract with the OSC. Based on this scenario, how would you score contractor?s implementation of MA.L2-3.7.1-Perform Maintenance?

As a Lead Assessor, you are in contact with the OSC Assessment Official. The Assessment Official has submitted a document that outlines the scope of your assessment engagement. You expect to find all the following elements on the Assessment Scope document, EXCEPT?