CCA CCA Risk Management & Vulnerabilities 2

Question 1

During a CMMC assessment, an assessor discovers an OSC has unpatched critical vulnerabilities on servers that store CUI. What is the appropriate assessor action?

Accepted Answer

Document the finding as 'Not Met' for the relevant patching/vulnerability management practices

Answer

Unpatched critical vulnerabilities on CUI-storing systems directly evidence failure of patch and vulnerability management practices, which must be documented as 'Not Met'.

Question 2

What is the primary purpose of threat intelligence in CMMC risk management?

Accepted Answer

To inform risk assessments and security decisions with current knowledge of threats facing defense contractors

Answer

Threat intelligence provides current information about adversarial tactics, techniques, and procedures relevant to defense contractors, helping organizations make informed risk management decisions.

Question 3

Which practice requires OSCs to monitor system security alerts and advisories under CMMC Level 2?

Accepted Answer

SI.2.214

Answer

SI.2.214 requires organizations to monitor system security alerts and advisories and take appropriate actions in response, supporting proactive vulnerability awareness.

Question 4

In CMMC risk management, what is meant by 'residual risk'?

Accepted Answer

The remaining risk after security controls have been applied

Answer

Residual risk is the level of risk that remains after security controls have been implemented, which organizations must decide to accept, transfer, or further mitigate.

Question 5

How does CMMC address the risk posed by insider threats?

Accepted Answer

Through practices such as least privilege, separation of duties, and personnel screening

Answer

CMMC addresses insider threat risk through access control practices (least privilege), personnel security practices, and audit/accountability requirements that collectively reduce and detect insider threats.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA CCA Risk Management & Vulnerabilities 2