Assess the Various Environmental Considerations of Organizations Seeking Certification (OSCs) Against CMMC Level 2 Practices CCA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An OSC uses a third-party cloud provider to host its CUI. Which of the following is an external environmental factor that the assessor should consider?

   • AThe cloud provider's compliance with relevant security standards
   • BThe network segmentation within the OSC's own network
   • CThe internal training program for OSC employees
   • DThe physical access controls at the OSC's headquarters
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During a physical environment assessment, which of the following is the primary purpose of evaluating the OSC's visitor access log?

   • ATo verify that the log is stored in a tamper-proof format
   • BTo determine the exact number of visitors per day for capacity planning
   • CTo confirm that only authorized personnel are granted physical access to sensitive areas
   • DTo ensure that the log is backed up to an off-site location
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An OSC has implemented strong physical security, including biometric access and 24/7 monitoring. The logical environment is well-segmented, and employees receive regular training. However, the OSC relies on a third-party cloud provider that has experienced several data breaches. The OSC has not reviewed the provider's security posture. Which environmental consideration is the most significant risk to CMMC Level 2 compliance?

   • AExternal environment, because the third-party provider's security is not assured.
   • BPhysical environment, because the provider's data centers are not assessed.
   • CLogical environment, because the provider's network is not segmented.
   • DPersonnel environment, because the provider's employees are not trained.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An OSC's facility is located in a shared office building. Which physical security control is most directly relevant to preventing unauthorized individuals from accessing the OSC's server room?

   • AA security awareness training program for employees
   • BAn electronic badge system with access restrictions
   • CA data encryption solution for stored files
   • DA firewall configured to restrict network traffic
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An OSC has implemented strong technical controls for CUI, including encryption and access controls. However, the assessor finds that employees can freely bring personal devices into the facility and connect them to the network, and the server room door is often propped open for ventilation. Which environmental consideration is the assessor most likely to conclude is the weakest link?

   • AThe logical environment, because the network is not segmented.
   • BThe physical environment, because physical access controls are not enforced.
   • CThe external environment, because third-party services are not managed.
   • DThe personnel environment, because employees are not trained on security policies.
   Reveal Solution Discussion Select an answer first