CCA Cybersecurity Practices & Controls 2

Question 1

Under CMMC 2.0, which practice requires organizations to limit system access to authorized users, processes acting on behalf of authorized users, and devices?

Accepted Answer

AC.L1-3.1.1

Answer

AC.L1-3.1.1 (Authorized Access Control) is a Level 1 practice that limits system access to authorized users, processes, and devices.

Question 2

Which CMMC domain addresses the need to establish and maintain baseline configurations for information technology systems?

Accepted Answer

Configuration Management (CM)

Answer

The Configuration Management (CM) domain includes practices for establishing and maintaining baseline configurations for IT systems.

Question 3

A CCA assessor finds that an organization uses shared accounts for multiple administrators. Which CMMC practice is most directly violated?

Accepted Answer

IA.L2-3.5.5 — Employ identifier management

Answer

IA.L2-3.5.5 requires identifier management, including ensuring individual identifiability, which shared accounts violate.

Question 4

What is the primary purpose of the Media Protection (MP) domain in CMMC?

Accepted Answer

To protect system media containing CUI, both paper and digital

Answer

The Media Protection domain focuses on protecting system media containing CUI, whether in physical (paper) or digital form.

Question 5

Which practice requires that CMMC Level 2 organizations scan for vulnerabilities in organizational systems and applications periodically?

Accepted Answer

RA.L2-3.11.2

Answer

RA.L2-3.11.2 requires periodic vulnerability scanning of organizational systems and hosted applications.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA Cybersecurity Practices & Controls 2