CCA Cybersecurity Practices & Controls 5

Question 1

Which CMMC practice requires organizations to protect CUI during transmission using FIPS-validated cryptography?

Accepted Answer

SC.L2-3.13.8 — Implement cryptographic mechanisms to protect CUI during transmission

Answer

SC.L2-3.13.8 requires cryptographic mechanisms—which for federal systems implies FIPS-validated algorithms—to protect CUI during transmission.

Question 2

An organization's network diagram shows that CUI systems and general IT systems share the same network segment. Which CMMC practice is most relevant?

Accepted Answer

AC.L2-3.1.3 — Control the flow of CUI in accordance with approved authorizations

Answer

AC.L2-3.1.3 requires controlling the flow of CUI using approved authorizations, which includes network segmentation to separate CUI from non-CUI systems.

Question 3

What is the role of a Third-Party Assessment Organization (C3PAO) in the CMMC ecosystem?

Accepted Answer

To independently assess and certify organizations seeking CMMC Level 2 or Level 3 certification

Answer

C3PAOs are authorized third-party organizations that conduct official CMMC assessments and issue certifications for Level 2 and Level 3.

Question 4

Which CMMC practice requires that remote access sessions be controlled and monitored?

Accepted Answer

AC.L2-3.1.12 — Monitor and control remote access sessions

Answer

AC.L2-3.1.12 specifically requires that remote access sessions be monitored and controlled to reduce the risk of unauthorized access.

Question 5

A CCA assessor is reviewing an organization's personnel security practices. Which practice requires screening individuals prior to granting access to CUI systems?

Accepted Answer

PS.L2-3.9.1 — Screen individuals prior to authorizing access to organizational systems

Answer

PS.L2-3.9.1 (Personnel Security) requires screening individuals before authorizing access to organizational systems containing CUI.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA Cybersecurity Practices & Controls 5