Q43. During the on-site assessment, the assessment team thoroughly evaluated an OSC’s systems, policies, procedures, and practices against the 110 CMMC Level 2 practices. Initially, they found several deficient areas where practices were not fully met. The OSC took advantage of the Limited Practice Deficiency Correction program, which allowed them to provide additional evidence and implement corrections for certain deficient practices during the assessment period. What status should the Lead Assessor recommend for CMMC Level 2 Certification if an OSC has 85 out of 110 practices scored as ‘MET’ after applying the Limited Practice Deficiency Correction program?

Q44. A vulnerability scan on a defense contractor’s system identifies a critical security flaw in a legacy database application that stores CUI. Remediating the flaw would require a complete overhaul of the application, causing significant downtime and potentially disrupting critical business functions. Given the potential consequences of remediation, the contractor is considering deferring the fix. Which course of action best aligns with the guidance of CMMC practice RA.L2-3.11.3 – Vulnerability Remediation?

Q45. After a security audit, a contractor documents specific vulnerabilities and deficiencies in an audit report. After examining its POA&M, you realize it has a clearly defined policy on addressing these deficiencies and by when. However, after interviewing the contractor’s security and compliance team, you learn that while an audit is regularly conducted, the remediating measures are not always taken, and when taken, they are not always practical. The security and compliance team informs you they have tried reaching the system administrator to explain the repercussions of this without success. What assessment objective has the contractor failed to implement from CMMC practice CA.L2-3.12.2 – Plan of Action?

Q46. After the Assessment Team has been formed and the OSC Point of Contact (PoC) and Assessment Official have been identified, your C3PAO appoints John as the Lead Assessor. During the kickoff meeting, John reassures the OSC Assessment Official not to worry; they are guaranteed to pass the CMMC assessment. If they don’t, John has agreed to refund 40% of the assessment fee. Which of the following is true about John’s behavior as a Certified CMMC Assessor?

Q47. You are the Lead Assessor for a CMMC assessment of an OSC that has previously obtained ISO 27001 certification for its information security management system. During the initial discussions, the OSC requests that you consider their ISO 27001 certification and grant them credit toward their CMMC certification. They believe there is a significant overlap between CMMC and ISO 27001. What should your response to the OSC be?

Q48. As a CCA, John feels he can make some extra cash by aggregating and rewriting CMMC materials into a book titledAcing Your CMMC Assessment: A Complete Guide. You ask him about potential issues, such as the failure to get permission from the Cyber Accreditation Body. John tells you that since he is a CCA, this is not a requirement, and in any case, the information is already publicly available. Has John broken any CoPC guiding principles or practices? If so, which one?

Q49. The assessment team is discussing the pre-assessment scope with an OSC. The OSC would like to limit the scope of the security requirements in environments that contain FCI and/or CUI. In this case, the OSC should:

Q50. You are a CCA reviewing evidence for a CMMC practice. The OSC provides a training record showing that only 70% of relevant staff have completed required security training. The practice requires all staff to be trained. How should you score this practice?

Q51. Both FCI and CUI are stored by an OSC on the same network. Server A contains file shares with FCI, and Server B contains file shares with CUI. The OSC hopes each server would only undergo the assessment for the classification of data it contains. What is the MOST correct assessment situation in this scenario?

Q52. The OSC’s network consists of a single network switch that connects all devices. This includes the OSC’s OT equipment, which processes CUI. The OT controller requires an unsupported operating system.
What can the Lead Assessor BEST conclude about the overall compliance with MA.L2-3.7.1: Perform Maintenance?

Q53. You are conducting a CMMC assessment for a contractor that develops software applications for the DoD.
During the assessment of the AU domain, you request to examine the contractor’s audit and accountability policies, access control procedures, and system configuration documentation related to the management of audit logging functionality. Upon reviewing the documentation, the contractor has implemented a Role-Based Access Control (RBAC) model, where privileged users are assigned different roles based on their responsibilities. One of these roles is the “Audit Administrator” role, which is granted the necessary privileges to manage audit logging functionality across the contractor’s systems. However, during interviews with the system administrators, you learn that besides the Audit Administrator role, several other privileged roles, such as the “System Administrator” and “Network Administrator” roles, can also manage audit logging functionality. When you inquire about the rationale behind granting multiple privileged roles access to audit management functions, the contractor’s security team explains that this approach allows for better operational flexibility and ensures that different teams can perform audit logging tasks based on their areas of responsibility. Based on the information provided in the scenario, how would you assess the contractor’s compliance with CMMC practice AU.L2-3.3.9 – Audit Management?

Q54. A CCA is assessing an Organization Seeking Certification (OSC). During the assessment, they discover that the OSC is pressuring the CCA to overlook certain security practices that do not meet the CMMC requirements. The organization threatens to withhold payment if the CCA does not modify her findings at the request of the OSC. According to the CoPC, which of the followingactions would be most appropriate for the CCA to take in this situation?

Q55. A defense contractor has a complex network design with multiple VLANs. The network is divided into three VLANs: VLAN 10 for the administrative offices, VLAN 20 for the engineering department, and VLAN 30 for the manufacturing floor. The company’s System Security Plan states that VLANs are used to create logical network segments and improve security. A Layer 3 switch is responsible for routing traffic between the VLANs, and the switch is configured to allow any type of traffic between the VLANs. How should VLANs be treated when defining the contractor’s CMMC Assessment Scope?

Q56. A CCA was part of an Assessment Team tasked with conducting a CMMC assessment for an OSC. Happy to have been part of the team that completed the assessment, the CCA posted the OSC’s assessment results on their Twitter/X account. Which CMMC Code of Professional Conduct (CoPC) principle has the CCA violated?

Q57. While conducting an assessment, an assessor is determining if privileged accounts are used for non-privileged functions. While interviewing a user with a privileged account, the assessor should ask if the person interviewed: