CMMC-CCA 試験問題を無料オンラインアクセス

An OSC assigns new hires to work on their hire date. Human Resources ensures that all screening activities are completed before the end of the employees' first week. How should the CCA score PS.L2-3.9.1: Screen Individuals?

• A.As NOT MET because all screening must be completed prior to the start of employment
• B.As NOT MET and this will cause the assessment to fail
• C.As NOT MET but it can be remediated post-assessment
• D.As MET since the OSC ensured Human Resources was handling the screening

An OSC has an established password policy. The OSC wants to improve its password protection security by implementing a single change. Which of the following is an acceptable element to add to the OSC's password policy?

• A.Add the use of salted two-way cryptographic hashes of passwords.
• B.Require passwords to be 5 to 7 characters long.
• C.Require passwords to be changed every 18 months.
• D.Add the use of salted one-way cryptographic hashes of passwords, where possible.

An Assessor is evaluating controls put in place by an OSC to restrict the use of privileged accounts. The Assessor interviews privileged users and confirms that the OSC has both a policy and specific procedures governing the use of privileged accounts for security functions. What else could the Assessor evaluate to validate the assertions made by the interviewed OSC staff?

• A.Test the processes for privileged accounts with privileged users
• B.Examine the system architecture of the OSC to identify privileged accounts
• C.Examine the procedure assigning privileged roles to non-privileged functions
• D.Test the processes for non-privileged accounts to perform privileged functions

An assessor is reviewing whether an organization appropriately analyzed the security impact of a new release of an application. Which of the following documents is MOST useful for the assessor to review?

• A.System audit logs showing that the change occurred, when, and by whom
• B.A description of the change from the software vendor
• C.Change Control Board (CCB) meeting minutes and supporting documents
• D.A log of security incidents/issues after the change was implemented

An OSC is presenting the CMMC Assessment to the C3PAO along with all supporting documentation. The supporting documents include drawings from a patent application that has not been filed with the patent office and are marked as attorney-client privileged. What document is recommended that the OSC and C3PAO sign?

• A.Non-disclosure agreement
• B.Formal contract
• C.Statement of Work
• D.Formal disclosure agreement