Confidently Practice Online with Free CMMC-CCA Exam Cram

You are testing a contractor?s mechanisms for implementing wireless access protection to their information systems. AC.L2-3.1.17-Wireless Access Protection mandates the contractor to implement measures to protect the WAPs, which after interviews, tests and examination of some documents, you realize the contractor has done a fair job to achieve compliance. Which of the following is an option for what the contractor must have addressed to obtain a score of MET in this practice?

A contractor plans to bid for a DoD contract and has installed new network file servers to separate their commercial and DoD work. When examining the server documentation, you realize the server has some open ports. Upon further testing, you know that the server has some default features that are not essential for file storage or transfer. The server has a default remote desktop functionality that allows users remote access to the server's desktop environment. Files are transferred by default using FTP which is less secure than Server Message Block (SMB) protocol. However, the contractor's operations do not require remote access capabilities. Although the roles of each system are defined in their configuration management policy, a user can install any application or service they need. After some interviews, you learn that this ensures every employee is comfortable using a system or software they are most conversant with, despite having defined services or software for carrying out specific functions. From this scenario, how has the contractor failed to meet the requirements of CM.L2.3.4.6-Least Functionality?

As the Lead Assessor conducting a CMMC Level 2 assessment for an OSC, the Assessment Team has thoroughly reviewed all evidence provided by the OSC for the in-scope CMMC practices. Throughout the assessment process, daily checkpoint meetings were held with the OSC to allow them to present additional evidence and clarify any concerns. After the final evidence review and discussions, the Team has determined that 92 out of the 110 CMMC Level 2 practices have been scored as 'MET.' Additionally, 18 practices have been scored as 'NOT MET,' with 5 of those practices deemed ineligible for a Plan of Action and Milestones (POA&M) due to their potential impact on network exploitation or CUI exfiltration. The OSC has provided a draft POA&M for the remaining 13 'NOT MET' practices, outlining their proposed remediation actions and timelines. After reviewing and validating the OSC?s revised POA&M, you determine that it meets all necessary criteria. However, during the Final Findings presentation, the OSC expresses disagreement with the scoring of one particular practice, claiming that they have substantial evidence demonstrating compliance with all objectives. How would you address this disagreement?

A defense contractor has implemented a secure wireless network infrastructure to support their operations and client engagements. They use the WPA2-Enterprise encryption protocol with AES-CCMP ciphers and the 802.1X port-based authentication framework to secure their wireless network. The wireless network infrastructure includes a Remote Authentication Dial-In User Service (RADIUS) server for centralized authentication and authorization of wireless clients. The contractor has deployed multiple Wireless Access Points (WAPs) throughout their office premises, each with its own Service Set Identifier (SSID) and VLAN configuration. Before granting wireless access, the contractor?s IT team verifies the device's compliance with their security standards and validates the user's credentials against the RADIUS server using EAP-TLS authentication. Which of the following actions would NOT be considered a best practice for the contractor to further strengthen their compliance with CMMC AC.L2-3.1.16-Wireless Access Authorization?

CMMC MA.L2-3.7.6-Maintenance Personnel, requires that maintenance personnel without required access authorization be supervised during maintenance activities. One of the ways organizations can achieve this is to develop a documented procedure for supervised maintenance activities. Which of the following elements should be excluded from the documented procedure?