CCA CMMC Framework & Domains 3

Question 1

Which CMMC domain addresses the protection of audit logs and monitoring of system activity?

Accepted Answer

Audit and Accountability (AU)

Answer

The Audit and Accountability domain covers requirements for creating, protecting, and reviewing audit logs of system events.

Question 2

A defense contractor stores CUI and processes it on cloud systems. Under CMMC 2.0, the cloud service provider must meet which standard?

Accepted Answer

FedRAMP Moderate or equivalent

Answer

Cloud service providers used by CMMC Level 2 contractors must meet FedRAMP Moderate or equivalent requirements.

Question 3

How does CMMC 2.0 differ from CMMC 1.0 in terms of maturity levels?

Accepted Answer

CMMC 2.0 reduced from 5 levels to 3 levels

Answer

CMMC 2.0 streamlined the framework from 5 maturity levels in CMMC 1.0 to 3 levels.

Question 4

Which CMMC practice, if not implemented, would most directly violate the 'Identification and Authentication (IA)' domain requirements?

Accepted Answer

Allowing shared user accounts for system administrators

Answer

Shared accounts undermine the ability to uniquely identify users, which is a core requirement of the IA domain.

Question 5

In the CMMC framework, 'Federal Contract Information' (FCI) is BEST described as:

Accepted Answer

Information provided by the government under a contract that is not intended for public release

Answer

FCI is information provided by or generated for the government under a contract, not intended for public release.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test