Assess the Various Environmental Considerations of Organizations Seeking Certification (OSCs) Against CMMC Level 2 Practices CCA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An OSC is subject to both CMMC Level 2 and GDPR because it processes personal data of EU citizens. The OSC's CUI is stored in the US. Which external environment consideration is most relevant?

   • AThe OSC must comply with GDPR requirements for personal data, which may affect how CUI is handled.
   • BThe OSC must delete all CUI to comply with GDPR.
   • CThe OSC must store all data in the EU to comply with GDPR.
   • DThe OSC must obtain consent from all employees to process CUI.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An OSC's IT team has implemented a policy that requires all CUI to be encrypted at rest and in transit. However, the team has not implemented any form of network monitoring or intrusion detection. Which logical environment control is most lacking?

   • AData encryption at rest.
   • BData encryption in transit.
   • CDetection of unauthorized access or malicious activity.
   • DAccess control to CUI.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An OSC has a policy that requires all employees to complete security awareness training annually. However, the assessor finds that many employees have not completed the training, and there is no enforcement mechanism. Which personnel environment consideration is most directly impacted?

   • AThe OSC's ability to conduct background checks.
   • BThe OSC's ability to maintain audit logs.
   • CThe effectiveness of the security awareness program.
   • DThe OSC's ability to enforce least privilege.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An OSC has implemented robust technical controls, including network segmentation, encryption, and access controls. However, the assessor finds that employees are not required to wear badges, visitors are not escorted, and the server room is unlocked. Additionally, the OSC's incident response plan is not tested, and employees are unaware of reporting procedures. Which environmental consideration is the assessor most likely to identify as the primary weakness?

   • APersonnel environment, because employees are not trained on incident reporting.
   • BPhysical environment, because physical access controls are weak.
   • CExternal environment, because third-party services are not managed.
   • DLogical environment, because technical controls are not sufficient.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During a personnel environment assessment, which of the following is the primary purpose of evaluating the OSC's security awareness training program?

   • ATo document the training for audit purposes
   • BTo ensure that training is conducted annually
   • CTo confirm that employees understand their security responsibilities and can apply them
   • DTo verify that training is delivered in a classroom setting
   Reveal Solution Discussion Select an answer first