Assess the Various Environmental Considerations of Organizations Seeking Certification (OSCs) Against CMMC Level 2 Practices CCA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An OSC has strong physical security controls but weak network segmentation. When integrating environmental considerations, what is the most appropriate conclusion for the assessor to draw?

   • AThe OSC should focus only on personnel training to compensate for the weak segmentation
   • BThe OSC's readiness is determined solely by its external environment
   • CThe OSC has a gap in its logical environment that could affect compliance
   • DThe OSC is fully ready for CMMC Level 2 because physical security is strong
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An OSC has a policy that requires employees to report security incidents within 24 hours. However, the assessor finds that employees are unsure how to report incidents and often do not report them at all. Which personnel environment consideration is most directly impacted?

   • AThe OSC's ability to conduct background checks.
   • BThe OSC's ability to maintain audit logs.
   • CThe OSC's ability to enforce least privilege.
   • DThe OSC's incident response capability.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An assessor is evaluating the personnel environment of an OSC. Which of the following is an example of a personnel factor that could affect CMMC Level 2 compliance?

   • AThe physical security of the data center
   • BThe network firewall configuration
   • CThe roles and responsibilities defined for system administrators
   • DThe contractual terms with a third-party vendor
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An OSC processes CUI on a flat network where all users can reach all systems. The IT administrator wants to segment the network to protect CUI. Which approach best aligns with CMMC Level 2 logical environment expectations?

   • AApply stricter password policies to all users to reduce the risk of unauthorized access.
   • BEnable encryption on all laptops to protect data at rest.
   • CInstall antivirus software on all endpoints to prevent malware from spreading.
   • DImplement VLANs to separate CUI systems from the general user network and restrict traffic with firewall rules.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An OSC has a high turnover rate among employees who handle CUI. The HR department conducts exit interviews but does not promptly revoke access to systems and facilities. Which personnel environment risk is most directly indicated?

   • ANew employees may not receive adequate training on CUI handling.
   • BEmployees may become disgruntled and intentionally leak CUI.
   • CFormer employees may retain access to CUI, leading to unauthorized disclosure.
   • DThe OSC may lose institutional knowledge when employees leave.
   Reveal Solution Discussion Select an answer first