CCA Cybersecurity Practices & Controls 3

Question 1

Which CMMC practice specifically requires organizations to separate user functionality from system management functionality?

Accepted Answer

SC.L2-3.13.3

Answer

SC.L2-3.13.3 requires separation of user functionality from system management functionality to reduce risk.

Question 2

A CCA assessor reviews an organization's incident response plan and finds no defined roles for handling a CUI breach. Which practice gap does this represent?

Accepted Answer

IR.L2-3.6.1 — Establish an operational incident-handling capability

Answer

IR.L2-3.6.1 requires establishing an incident-handling capability that includes defined roles and responsibilities.

Question 3

What does the CMMC practice PE.L1-3.10.1 require?

Accepted Answer

Limit physical access to organizational systems to authorized individuals

Answer

PE.L1-3.10.1 (Physical Protection) requires limiting physical access to systems, equipment, and the respective operating environments to authorized individuals.

Question 4

Which NIST SP 800-171 control family maps to the CMMC Audit and Accountability (AU) domain?

Accepted Answer

Control Family 3.3 — Audit and Accountability

Answer

CMMC's AU domain maps directly to NIST SP 800-171 Control Family 3.3, Audit and Accountability.

Question 5

An organization uses a SIEM tool to aggregate and review security logs. Which CMMC practice is best supported by this control?

Accepted Answer

AU.L2-3.3.2 — Ensure the actions of individual users can be traced

Answer

AU.L2-3.3.2 requires that individual user actions be traceable through logs, which a SIEM directly supports by aggregating and analyzing audit data.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA Cybersecurity Practices & Controls 3