Cyber AB CMMC-CCA Practice Exam Questions & Answers

The next step after configuring audit logs and ensuring event content is correct is to periodically review and update the logged events to maintain alignment with evolving security requirements and risks.

Extract from AU.L2-3.3.2 & AU.L2-3.3.7:

''Organizations must review and update audit log events periodically to ensure they continue to support accountability and monitoring objectives.''

While centralized collection and retention are important, the next required objective per progression is review and update of logged events.

Per the CMMC Scoping Guidance, CUI Assets are those that process, store, or transmit CUI. Since System CUI is the system handling CUI data, it must be categorized as CUI Assets.

Extract:

''CUI Assets are any assets that process, store, or transmit CUI. These assets are in-scope for assessment and must meet CMMC practice requirements.''

Thus, the best classification for System CUI is CUI Assets.

Applicable Requirement: SC.L2-3.13.16 --- ''Protect the confidentiality of CUI at rest.''

Why D is Correct: Cryptographic mechanisms (e.g., full-disk encryption, database encryption, file encryption) provide the strongest protection for information at rest by preventing unauthorized disclosure if systems or media are accessed.

Why Other Options Are Insufficient:

A (Patching): Protects against vulnerabilities, but not specific to data-at-rest confidentiality.

B (File share): Provides a storage method, not protection.

C (Secure offline storage): Helps physically, but not sufficient for digital confidentiality without encryption.

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- SC.L2-3.13.16

NIST SP 800-171A --- SC.L2-3.13.16 Assessment Objectives

CMMC Assessment Guide -- Level 2, Data at Rest Protection

The Escort Visitors practice falls under Physical and Environmental Protection (PE.L2-3.10.3), which requires organizations to escort visitors and monitor visitor activity. To validate this, the assessor should interview personnel responsible for physical access control (security guards, facility access managers) and information security (to confirm integration with CUI protection requirements).

Exact Extracts:

PE.L2-3.10.3: ''Escort visitors and monitor visitor activity.''

Assessment Guide: ''Interview personnel responsible for physical access control and security monitoring to confirm escort and visitor activity tracking.''

Assessment Objectives: Require evidence of visitor escorts, visitor logs, and monitoring practices.

Why the other options are not correct:

A (Repair/maintenance): Not responsible for escort procedures.

B (Local access control only): Missing the information security link, which ensures visitors cannot access CUI assets.

D (IT management): IT is not responsible for escorting visitors in physical spaces.

CMMC Assessment Guide -- Level 2, Version 2.13: PE.L2-3.10.3 (pp. 154--156).

NIST SP 800-171A: Assessment procedures for visitor escort and monitoring.

For IA.L2-3.5.1 (Identify system users, processes, and devices), the strongest evidence is direct lists of accounts, devices, and supporting audit logs/records that show users and devices are actively identified and managed. Policies and procedures are supporting evidence but not as strong as system-generated, real evidence.

Extract:

''Strong evidence includes account listings, device inventories, and audit logs demonstrating that all users, processes, and devices are identified and uniquely associated.''