Assess the Various Environmental Considerations of Organizations Seeking Certification (OSCs) Against CMMC Level 2 Practices CCA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An OSC's IT team has configured all workstations with full disk encryption and enabled firewalls. However, they have not implemented any form of network segmentation, and all users can access the file server containing CUI. Which logical environment control is most lacking?

   • AData encryption in transit.
   • BAudit logging of user activity.
   • CEndpoint protection against malware.
   • DAccess restrictions to CUI based on user roles.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A small defense contractor operates from a leased office suite in a multi-tenant commercial building. The suite has a locked entrance, but shared hallways and a common lobby are accessible to other tenants. The contractor's server room door is unlocked during business hours, and the room also serves as a storage closet. During a CMMC Level 2 assessment, which physical security control should the assessor most likely identify as a gap?

   • AThe server room lacks a mantrap or security turnstile at its entrance.
   • BThe server room door is not locked and is accessible to unauthorized personnel during business hours.
   • CThe building lacks a 24/7 security guard at the main lobby entrance.
   • DThe contractor has not installed security cameras in the shared hallway.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An OSC uses a third-party cloud provider to host its CUI. The provider's data centers are located in a foreign country. The OSC's contract with the provider does not specify where data is stored or processed. Which external environment consideration is most critical for the assessor to evaluate?

   • AThe provider's backup and recovery procedures.
   • BThe provider's compliance with international data protection regulations.
   • CThe provider's physical security measures at its data centers.
   • DThe OSC's ability to ensure CUI is stored and processed only in approved locations.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An assessor is reviewing the OSC's system configurations. Which of the following is an example of a logical environment factor that could affect CMMC Level 2 compliance?

   • AThe use of a secure configuration baseline for servers
   • BThe security clearance level of the system administrator
   • CThe physical locks on the server room door
   • DThe contractual requirements from a cloud service provider
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of an external environmental factor that can affect an OSC's CMMC Level 2 compliance?

   • AThe OSC's internal password policy
   • BThe skills of the OSC's security team
   • CThe physical layout of the OSC's office
   • DThe regulatory requirements imposed by the government on the OSC's industry
   Reveal Solution Discussion Select an answer first