CMMC-CCA 무료 덤프문제 온라인 액세스

FIPS-validated cryptography is required to meet CMMC practices that protect CUI when transmitted or stored outside the OSC's CMMC enclave. What source does the CCA use to verify that the cryptography the OSC has implemented is FIPS-validated?

• A.NIST Module Validation Program
• B.Cryptographic section of the Shared Responsibility Matrix
• C.Cryptographic section of the OSC's SSP
• D.Vendor cryptographic module documentation

An OSC processes data in its owned data center. The data center includes a very early smoke detection apparatus (VESDA). The apparatus only captures log information from its sensors around the data center. It is not intended, nor capable of, processing CUI. The VESDA is on a separate VLAN and is in a separate locked room in the data center.
Should the assessor agree that the VESDA is out-of-scope?

• A.No. Even though the sensors are out-of-scope, the VESDA could provide access to the outside network if sensors were misused, and CUI could be exfiltrated.
• B.No. Even though the VESDA controller is in a locked room and on a separate VLAN, the VESDA is an essential security function as an early warning system.
• C.Yes. The VESDA serves a non-data processing purpose and is only connected to sensors. Sensors are out-of-scope, so the VESDA is out-of-scope.
• D.Yes. The VESDA is physically and logically separated from the other data center equipment, and it is not intended nor capable of processing CUI.

An OSC creates standard user accounts with limited capabilities and administrator accounts with full system access. A standard user initiates the uninstall of the anti-virus software, which is organizationally defined as a privileged function. Which of the following would indicate AC.L2-3.1.7: Privileged Functions is properly implemented?

• A.The antivirus software is successfully uninstalled.
• B.The antivirus software is successfully uninstalled, and the event is captured in an application audit log.
• C.The antivirus software is not uninstalled.
• D.The antivirus software is not uninstalled, and the attempt is captured in an application audit log.

During an assessment, the Lead Assessor determines certain assets to be in-scope which the OSC had considered out-of-scope.
The CCA should reply that for assets to be considered out-of-scope they:

• A.Do not provide security protections for CUI assets.
• B.Can, but are not intended to, process, store, or transmit CUI.
• C.Provide security protections to CUI assets.
• D.Are not required to be physically or logically separated from CUI assets.

An OSC is presenting the CMMC Assessment to the C3PAO along with all supporting documentation. The supporting documents include drawings from a patent application that has not been filed with the patent office and are marked as attorney-client privileged. What document is recommended that the OSC and C3PAO sign?

• A.Non-disclosure agreement
• B.Formal contract
• C.Statement of Work
• D.Formal disclosure agreement