A C3PAO has contracted by an OSC to perform its assessment. Before the assessment, the Lead Assessor asks the OSC to provide an extensive list of evidence, some of which is optional and beyond the minimum requirements. The OSC is not able to fulfill the entire request. One missing document was a current and organized list of the OSC's evidence and mappings.
Given that this is a Level 2 Assessment, what should the Lead Assessor tell the OSC?

• A. "The OSC's Assessment Official will be asked to collect evidence when requested by the assessment team."
• B. "It's okay that the document is missing. The Assessment Team will collect all evidence themselves to ensure its integrity."
• C. "The OSC must provide the Assessment Team with hardcopy evidence. Electronic evidence will only be collected when needed."
• D. "The OSC should provide the Assessment Team with a current and organized list of their evidence and process mappings, but the assessment can continue."

解説: (CertJuken メンバーにのみ表示されます)

While conducting a CMMC Level 2 Third-Party Assessment of a small defense contractor, an assessor discovers that the contractor's Information Security Policy has no documented change records demonstrating executive approval. The IT director states that they will add change records in the future, but that other evidence exists. Which documentation is MOST able to demonstrate persistent and habitual adherence to CMMC requirements?

• A. Handwritten notes from executive committee meetings discussing implementation
• B. Transcribed interviews with new employees discussing their understanding of information security policies
• C. Several years' worth of saved emails from the executive team approving policies and directing adherence
• D. A notarized letter from the previous CEO stating that they approved information security policies annually

解説: (CertJuken メンバーにのみ表示されます)

While conducting a CMMC Level 2 Assessment for a small waveguide manufacturer, the client provides a copy of their CMMC Level 1 Self-Assessment that their senior official has recently approved and uploaded to the Supplier Performance Risk System (SPRS). What type of information may be covered within the Level 1 Self-Assessment that is OUTSIDE the scope of a Level 2 assessment?

• A. FCI data within the description in the contractor self-assessment
• B. Sensitive Compartmented Information (SCI) shredded by an approved vendor
• C. FCI within the CUI production enclave
• D. CUI in paper format

解説: (CertJuken メンバーにのみ表示されます)

During an assessment, the OSC IT security team provided documentation on how they use replay-resistant authentication to protect CUI. What can be used as a replay-resistant mechanism?

• A. Encrypted messages
• B. MFA devices to protect access for local users
• C. Biometric techniques
• D. Requiring Transport Layer Security (TLS)

解説: (CertJuken メンバーにのみ表示されます)

During a company's assessment, the CCA notices that the server room door is kept open with a fan in the entryway because the cooling system is inadequate and the machines are overheating. According to the physical protection policy, the server room's keypad is the mechanism for managing and controlling access to this equipment, and only the IT team should have access to the server room. However, with the door open, the keypad is not necessary, and anyone can enter the room.
The CCA asks the IT manager how access to this room is protected while the door is open. Which response would allow the company to still meet the physical security requirement?

• A. "The server is located inside another room that only the IT team has access to."
• B. "We trust our employees not to enter the room if they are not supposed to."
• C. "Only employees are allowed in this area."
• D. "The CEO emailed all employees that the server room door would be kept open but only the IT team should enter."

解説: (CertJuken メンバーにのみ表示されます)