Cyber AB CMMC-CCA問題集で必ず試験合格させる
CMMC-CCA試験問題（更新されたのは2026年）100%リアル問題解答
Cyber AB CMMC-CCA 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
質問 # 23
During the Planning phase, the C3PAO and Lead Assessor will collect information from the OSC to provide a Rough Order of Magnitude (ROM). This enables the Assessor to approximate the duration, schedule, and cost of the Assessment. To determine the Rough Order of Magnitude (ROM), the Lead Assessor can use the following inputs, EXCEPT?
- A. The OSC's readiness.
- B. Education levels of the Assessment Team.
- C. The size and complexity of the OSC.
- D. The OSC's location and number of facilities.
正解：B
解説：
Comprehensive and Detailed in Depth Explanation:
The CAP lists OSC-related inputs for ROM (Options A, C, D), but team education (Option B) is irrelevant to this estimate.
Extract from Official Document (CAP v1.0):
* Section 1.5 - Assessment Planning (pg. 16):"ROM inputs include OSC location, size, complexity, and readiness." References:
CMMC Assessment Process (CAP) v1.0, Section 1.5.
質問 # 24
As the Lead Assessor conducting a CMMC Level 2 assessment for an OSC, the Assessment Team has thoroughly reviewed all evidence provided by the OSC for the in-scope CMMC practices. Throughout the assessment process, daily checkpoint meetings were held with the OSC to allow them to present additional evidence and clarify any concerns. After the final evidence review and discussions, the Team has determined that 92 out of the 110 CMMC Level 2 practices have been scored as 'MET.' Additionally, 18 practices have been scored as 'NOT MET,' with 5 of those practices deemed ineligible for a Plan of Action and Milestones (POA&M) due to their potential impact on network exploitation or CUI exfiltration. The OSC has provided a draft POA&M for the remaining 13 'NOT MET' practices, outlining their proposed remediation actions and timelines. In reviewing the OSC's draft POA&M, you notice that one of the proposed remediation actions involves implementing a new security control that could potentially impact the effectiveness of another practice that was scored as 'MET.' How should you proceed?
- A. Request the OSC to revise the POA&M, removing any actions that could limit the effectiveness of practices scored as 'MET.'
- B. Reject the entire POA&M and require the OSC to resubmit it with all necessary corrections.
- C. Note the concern but allow the POA&M to proceed, as the impact on other practices can be reassessed during the next CMMC assessment.
- D. Accept the POA&M as it is, provided that the proposed remediation timelines are reasonable.
正解：A
解説：
Comprehensive and Detailed in Depth Explanation:
The CAP prohibits POA&M actions that impair 'MET' practices, requiring revision (Option C). Options A and B risk certification integrity, and Option D is overly harsh when targeted revision suffices.
Extract from Official Document (CAP v1.0):
* Section 2.3.2 - Deficiency Correction (pg. 28):"Remove any POA&M actions that limit the effectiveness of practices scored as 'MET.'" References:
CMMC Assessment Process (CAP) v1.0, Section 2.3.2.
質問 # 25
You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 - Report Recommended Assessment Results. You are preparing to deliver the final recommended findings to the OSC Assessment Official and OSC participants during the Final Findings Briefing. After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?
- A. The OSC submits an appeal using the Assessment Appeals Process if it disagrees with the findings.
- B. You submit the Assessment Results Package directly to CMMC eMASS.
- C. You archive all assessment artifacts and dispose of them after three years.
- D. The C3PAO CQAP conducts an internal quality review of the Assessment Results Package.
正解：D
解説：
Comprehensive and Detailed in Depth Explanation:
The CAP requires a CQAP quality review before eMASS submission (Option A), not immediate submission (Option C), appeals (Option B, optional), or archiving (Option D, later step).
Extract from Official Document (CAP v1.0):
* Section 3.2 - Report Assessment Results (pg. 32):"The C3PAO CQAP conducts an internal quality review of the Assessment Results Package post-Final Findings Briefing." References:
CMMC Assessment Process (CAP) v1.0, Section 3.2.
質問 # 26
You are a CCA with an active and good standing on the Cyber AB Marketplace. An OSC has contracted your C3PAO for a prospective CMMC Assessment. The OSC provides signal processing services for the DoD.
You assisted the OSC in preparing for the upcoming CMMC assessment by conducting an initial evaluation of their implementation practices. With your background in cybersecurity and extensive experience, your C3PAO and Lead Assessor have selected you to join the Assessment Team. Based on this scenario, which of the following is the most important factor for the C3PAO to consider when assigning assessors to the Assessment Team?
- A. The Assessor's hourly rate, especially for independent assessors.
- B. The Assessor's active status and good standing as a CMMC Certified Assessor or Professional, verified on the Cyber AB Marketplace, are important factors.
- C. The Assessor's professional reputation within the CMMC ecosystem.
- D. The Assessor's specialization with the OSC's lines of business or industry sub-sector.
正解：B
解説：
Comprehensive and Detailed in Depth Explanation:
The CAP prioritizes verified credentials (Option A), though the CCA's prior consulting role creates a conflict (CoPC Paragraph 3.1), which should preclude assignment. The question focuses on general factors, making A correct.
Extract from Official Document (CAP v1.0):
* Section 1.5 - Assessment Team Roles (pg. 16):"The C3PAO must verify that all assessment team members possess an active status in good standing as a CMMC Certified Assessor or Professional." References:
CMMC Assessment Process (CAP) v1.0, Section 1.5; CoPC Paragraph 3.1.
質問 # 27
You are the CCA working with a client to deliver certified consulting services, and the OSC has asked how to ensure their scope is accurate. You mention the use of a data flow diagram, which intrigues the OSC. What would be the first step in constructing the data flow diagram for the OSC?
- A. Gather information about the OSC's network infrastructure and create a network diagram
- B. Conduct interviews with key stakeholders to understand the organization's business processes
- C. Identify how data flows through the OSC's business, including systems, subprocesses, and data stores, identifying major inputs and outputs to the environment
- D. Implement a Data Loss Prevention (DLP) tool to monitor data flows within the OSC
正解：C
解説：
Comprehensive and Detailed in Depth Explanation:
The CMMC Assessment Guide Level 2 identifies the first step in constructing a data flow diagram as mapping data flows, including inputs/outputs, systems, and subprocesses (Option C), to define CUI scope.
Option A (DLP) is a control, not a step. Option B (interviews) supports but follows identification. Option D (network diagram) is separate. Option C is the correct answer.
Reference Extract:
* CMMC AG Level 2, Section 1.3:"Begin data flow diagrams by identifying data flows, inputs, outputs, and systems."Resources:https://dodcio.defense.gov/Portals/0/Documents/CMMC
/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf
質問 # 28
An aerospace company bids on a DoD contract that requires CMMC Level 2 compliance. The company has multiple divisions, but only the Manufacturing Division will work on the project. The Manufacturing Division has its own IT infrastructure and security policies, but it relies on the company's centralized IT department for some administrative tasks. Which of the following is the Host Unit in this scenario?
- A. The company's centralized IT department
- B. The office environment
- C. The Manufacturing Division
- D. The entire aerospace company
正解：C
解説：
Comprehensive and Detailed Explanation:
The CMMC Assessment Scope - Level 2 defines the Host Unit as the specific organizational unit (people, processes, technology) directly tied to the DoD contract and subject to the CMMC assessment. Here, the Manufacturing Division performs the contract work and has its own IT infrastructure, making it the Host Unit (OSC). The centralized IT department is a Supporting Organization, not the Host Unit, as it provides ancillary services. Option C is too broad, and Option B is vague and incorrect. A is correct per the scoping guide.
Reference:
CMMC Assessment Scope - Level 2, Section 2.1 (Host Unit Definition), p. 3: "The Host Unit is the unit performing the contract work."
質問 # 29
When assessing an OSC's implementation of the System and Information Integrity (SI) practices, you examine their system and information integrity policy. You find that they have documented procedures addressing system monitoring tools and techniques, along with a monitoring strategy. The OSC has implemented a user behavior analytics tool to detect abnormal behavior anddeviations from normal patterns.
To ensure that only authorized users access the system, the OSC uses robust access controls and regularly audits security and system logs for unusual activities. Interviewing the network administration team, you learn they use a network monitoring tool to track inbound and outbound network traffic and identify any distinctive patterns that may suggest unauthorized use. You also learn that they use an IDS to identify suspicious activities, which are aggregated and analyzed using a state-of-the-art SIEM. The scenario mentions that the OSC uses a network monitoring tool to track inbound and outbound traffic and identify unusual patterns.
However, it does not provide details on the tool's specific techniques or methods. Which of the following techniques would be most relevant for the assessor to inquire about during the assessment?
- A. Deep packet inspection techniques
- B. Signature-based detection techniques
- C. Anomaly-based detection techniques
- D. Both signature-based and anomaly-based detection techniques
正解：D
解説：
Comprehensive and Detailed In-Depth Explanation:
CMMC practice SI.L2-3.14.6 - Monitor Communications for Attacks requires organizations to "monitor organizational communications at external boundaries and key internal boundaries for attacks or indicators of potential attacks." Effective monitoring typically employs bothsignature-based detection(identifying known threats via predefined patterns) andanomaly-based detection(flagging deviations from normal behavior), as these complementary techniques provide comprehensive coverage against known and emerging threats. The OSC's use of IDS, SIEM, and user behavior analytics suggests a mix of capabilities, but the specific techniques aren't detailed. Inquiring about both (C) ensures the assessor verifies a robust approach, as recommended by the CMMC guide. Anomaly-based (A) or signature-based (B) alone are insufficient, and while deep packet inspection (D) is useful, it's a narrower method not explicitly required.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), SI.L2-3.14.6: "Monitoring includes signature-based and anomaly-based detection to identify attacks."
* NIST SP 800-171A, 3.14.6: "Interview personnel to determine monitoring techniques, including signature and anomaly detection." Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf
質問 # 30
As a CCA, John feels he can make some extra cash by aggregating and rewriting CMMC materials into a book titledAcing Your CMMC Assessment: A Complete Guide. You ask him about potential issues, such as the failure to get permission from the Cyber Accreditation Body. John tells you that since he is a CCA, this is not a requirement, and in any case, the information is already publicly available. Has John broken any CoPC guiding principles or practices? If so, which one?
- A. Yes, adherence to materials and methods.
- B. Yes, information integrity.
- C. No, he has not.
- D. Yes, respect for intellectual property.
正解：A
解説：
Comprehensive and Detailed in Depth Explanation:
Creating derivative works from CMMC materials without Cyber AB permission violates Adherence to Materials and Methods (Option D), not Integrity (Option B) or IP (Option C, though related). Option A is incorrect.
Extract from Official Document (CoPC):
* Paragraph 3.3(3) - Proper Use of Methods (pg. 7):"Do not create derivative works using CMMC intellectual property without explicit written permission from the Cyber AB." References:
CMMC Code of Professional Conduct, Paragraph 3.3(3).
質問 # 31
A company receives data that they suspect is CUI, but it is not marked as such. What is an acceptable way for the company to handle unmarked potential CUI?
- A. Have a procedure for proper handling of unlabeled data.
- B. If data are not marked, then they are not CUI.
- C. Have a procedure for deleting unlabeled data.
- D. Treat all data as CUI even if not marked.
正解：A
解説：
The CMMC Assessment Guide (Level 2) requires organizations to have a documented procedure for the identification and handling of unmarked potential CUI. The DoD guidance specifies that contractors cannot assume unmarked data is not CUI; instead, they must have a process to ensure unmarked potential CUI is handled properly until its classification is clarified.
Extract from Assessment Guide:
"Organizations must establish procedures for the handling of unmarked data that is suspected of being CUI.
These procedures should define how unmarked information is protected until such time its status can be determined." Therefore, the correct answer is to have a procedure for proper handling of unlabeled data.
Reference: CMMC Assessment Guide, Level 2, CUI Handling Practices.
質問 # 32
An OSC is presenting evidence of its fulfillment of CM.L2-3.4.1: System Baselining. It provides:
* System inventory records showing additions/removals of machines,
* Software inventory showing installations/removals, and
* A system component installation plan with software needs and user specifications.
What other documentation MUST the company present to illustrate compliance with CM.L2-3.4.1?
- A. Documentation of the physical safeguards protecting the "gold" baseline images
- B. Documentation of any authorized deviations from the system baselines for end-user computers
- C. Documentation of a formal baseline review integrated with a system development lifecycle
- D. Documentation of a formal chain of custody for new hardware on which baselines will be installed
正解：B
解説：
* Applicable Requirement: CM.L2-3.4.1 - "Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles."
* Why C is Correct: Baseline management requires documenting and tracking authorized deviations to ensure systems remain consistent with approved baselines. Evidence must show the OSC manages exceptions as part of its configuration management process.
Why Other Options Are Insufficient:
* A: Physical safeguards protect images but do not demonstrate baseline management.
* B: Reviews may be helpful, but deviations are explicitly required documentation.
* D: Chain of custody applies to asset tracking, not baseline management.
References (CCA Official Sources):
* NIST SP 800-171 Rev. 2 - CM.L2-3.4.1
* NIST SP 800-171A - CM.L2-3.4.1 Assessment Objectives
* CMMC Assessment Guide - Level 2, Baseline Configurations
質問 # 33
As the Lead Assessor for your Assessment Team, you are validating an OSC's scope in readiness to start the assessment. You learn that the OSC provides its employees with laptops to work on DoD projects. These laptops have an antivirus solution that connects to a management console to receive updates, send alerts, and control settings. However, the server does not process, store, or transmit CUI but implements several CMMC controls. Which of the following is NOT part of the OSC's requirements regarding the antivirus solution?
- A. Logically separate the antivirus solution from other CUI assets.
- B. Itemize the solution in the CMMC Assessment Scope's network diagram and prepare it to be assessed against CMMC practices.
- C. The OSC should document it in the System Security Plan (SSP).
- D. They should document the specifics of the antivirus solution in the asset inventory.
正解：A
解説：
Comprehensive and Detailed Explanation:
The antivirus solution is a Security Protection Asset (SPA), per the CMMC Assessment Scope - Level 2, requiring documentation in the network diagram (Option A), asset inventory (Option B), and SSP (Option C), and assessment against CMMC practices. Logical separation (Option D) is not required for SPAs, which must integrate with the CUI environment to function. D is not a requirement.
Reference:
CMMC Assessment Scope - Level 2, Section 2.3.3 (SPAs), p. 6: "SPAs are documented and assessed, not separated from CUI assets."
質問 # 34
When assessing a contractor's implementation of CMMC practices, you examine its System Security Plan (SSP) to identify its documented measures for audit reduction and reporting. They have a dedicated section in their SSP addressing the Audit and Accountability requirements. You proceed to interview their information security personnel, who informed you that the contractor has a dedicated Security Operations Center (SOC) and uses Splunk to reduce and report audit logs. How would you score the contractor's implementation of AU.
L2-3.3.6 - Reduction & Reporting?
- A. Partially Met
- B. Not Applicable
- C. Met
- D. Not Met
正解：C
解説：
Comprehensive and Detailed In-Depth Explanation:
AU.L2-3.3.6 requires "providing audit reduction and report generation capabilities." The SSP documents measures, and Splunk (a SIEM) supports reduction and reporting, meeting both objectives. With no gaps noted, this 1-point practice scores Met (+1) per DoD methodology. Partial (A) and Not Met (C) require deficiencies, and N/A (B) doesn't apply.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), AU.L2-3.3.6: "Examine tools like SIEM for reduction and reporting."
* DoD Scoring Methodology: "1-point practice: Met = +1."
Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf
質問 # 35
You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery. How will proper separation of duties help the contractor meet the intent of AC.L2-3.1.4 - Separation of Duties?
- A. It simplifies the development process
- B. It reduces the overall cost of software development
- C. It allows the engineers to specialize in specific areas
- D. It reduces concentrated privileges and power and improves checks & balances. Errors and malicious actions are more likely to be caught. Risk is reduced without relying solely on one individual
正解：D
解説：
Comprehensive and Detailed In-Depth Explanation:
AC.L2-3.1.4 requires "separating duties to reduce risk of unauthorized activity." A single engineer handling all tasks concentrates privileges, increasing error or malice risks. Separation (B) distributes responsibilities, enhancing oversight and reducing reliance on one person, per CMMC intent. Specialization (A), cost (C), and simplicity (D) are secondary or irrelevant.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), AC.L2-3.1.4: "Separation reduces risk via checks and balances."
* NIST SP 800-171A, 3.1.4: "Distribute duties to mitigate insider threats." Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf
質問 # 36
The DoD has awarded a defense contractor a contract to deliver next-gen jet engine parts. The order requires the contractor to submit the blueprints/CAD files within six months, and once they are validated, the contractor submits a production schedule. The contractor indicates that they should be able to deliver the components in three years. Which of the following is true about the dates and schedule of the engine components?
- A. They must be protected in accordance with FAR 52.204-21
- B. They are part of the OSC's CUI
- C. They must be properly marked and labeled
- D. They must be protected under NIST SP 800-171
正解：A
解説：
Comprehensive and Detailed in Depth Explanation:
Delivery dates and production schedules are Federal Contract Information (FCI), not CUI, per FAR 52.204-
21, which governs basic safeguarding of FCI in DoD contracts. Option A (NIST SP 800-171) applies to CUI, not FCI. Option B (marking) is CUI-specific, not required for FCI schedules. Option C (CUI classification) is incorrect-blueprints are CUI, but schedules are FCI. Option D correctly identifies FAR 52.204-21 as the protection standard for FCI, making it the correct answer.
Reference Extract:
* FAR 52.204-21(b):"Safeguard FCI, including contract schedules, not intended for public release." Resources:Implied from CMMC context (FAR referenced in DoD contracts).
質問 # 37
An assessor is reviewing whether an organization appropriately analyzed the security impact of a new release of an application. Which of the following documents is MOST useful for the assessor to review?
- A. A log of security incidents/issues after the change was implemented
- B. A description of the change from the software vendor
- C. System audit logs showing that the change occurred, when, and by whom
- D. Change Control Board (CCB) meeting minutes and supporting documents
正解：D
解説：
* Applicable Requirement: CM.L2-3.4.3 - "Track, review, approve/disapprove, and audit changes to organizational systems."
* Why CCB Minutes Are Correct (supports B):
* Change Control Board (CCB) documentation includes impact analyses, approvals, disapprovals, and justification for system changes.
* The CMMC Assessment Guide explicitly identifies CCB minutes and supporting records as primary evidence of compliance with change management practices.
Why Other Options Are Insufficient:
* A (Vendor description): Provides information on the update, but does not show organizational review or approval.
* C (Audit logs): Show when a change occurred, but not whether it was analyzed and approved beforehand.
* D (Incident logs): Reflects results after implementation, but not the review/approval process.
Assessment Guidance Extract (NIST SP 800-171A, CM.L2-3.4.3):
* Objectives include verifying that system changes are:
* Documented,
* Reviewed,
* Approved/disapproved, and
* Audited.
* Evidence such as CCB minutes and approval records directly satisfies these objectives.
References (CCA Official Sources):
* NIST SP 800-171 Rev. 2 - CM.L2-3.4.3 (Change Management)
* NIST SP 800-171A - Assessment Objectives for CM.L2-3.4.3
* CMMC Assessment Guide - Level 2, Version 2.13 - Change Management evidence expectations
質問 # 38
An OSC is planning a CMMC Level 2 assessment that your C3PAO will conduct. In Phase 1.6.1 - Access and Verify Evidence, as the Lead Assessor, you are verifying the existence and accessibility of the evidence provided by the OSC. While reviewing the list of evidence mapped against the CMMC practices, you discover that the OSC cannot locate several critical system security policies for key IT systems supporting their DoD contracts. These missing policies are essential for demonstrating compliance with various CMMC practices related to access control, incident response, and system maintenance. What is the primary role of the CMMC Quality Assurance Professional (CQAP) regarding the Pre-Assessment Form?
- A. To configure access controls within the CMMC eMASS system.
- B. To assign roles and responsibilities for each Assessment Team member.
- C. To verify the accuracy and completeness of the information before uploading to CMMC eMASS.
- D. To schedule CMMC eMASS training sessions for C3PAO representatives.
正解：C
解説：
Comprehensive and Detailed in Depth Explanation:
The CQAP's primary role in Phase 1 is to ensure Pre-Assessment Form accuracy before eMASS upload (Option A). Options B, C, and D are not CQAP duties.
Extract from Official Document (CAP v1.0):
* Section 1.6 - Prepare for Assessment (pg. 18):"The CQAP verifies the accuracy andcompleteness of the Pre-Assessment Form data before uploading to CMMC eMASS." References:
CMMC Assessment Process (CAP) v1.0, Section 1.6.
質問 # 39
During the initial engagement with an OSC, they appoint an OSC Point of Contact (PoC). The Assessment Official informs your Assessment Team that they will regularly collaborate with the PoC in their daily engagements and assigns several responsibilities to this Point of Contact. Which of the following is not one of the OSC PoC's responsibilities?
- A. Managing logistics, such as ensuring adequate space for the team to meet with OSC representatives.
- B. Reviewing assessment results with the Lead Assessor.
- C. Handling facility access and escorting daily visitors.
- D. Coordinating site access and communicating visitation policies.
正解：B
解説：
Comprehensive and Detailed in Depth Explanation:
The OSC PoC's role, per CAP, focuses on logistics and facilitation, not reviewing assessment results, which is the OSC Assessment Official's responsibility. Option A, C, and D are explicit PoC duties. Option B is incorrect as it exceeds the PoC's scope.
Extract from Official Document (CAP v1.0):
* Section 1.3 - Identify OSC PoC (pg. 12):"The OSC PoC facilitates logistics, site access, and coordination of SMEs, but reviewing assessment results is the responsibility of the OSC Assessment Official." References:
CMMC Assessment Process (CAP) v1.0, Section 1.3.
質問 # 40
Steve is a Certified CMMC Assessor (CCA) who works for ACME Inc., which is both an RPO and a C3PAO.
His aunt Mary works for ABC Holdings, and based on this connection, Steve convinces her boss to hire ACME Inc. to help prepare for a CMMC assessment. Steve leads the team and successfully completes the engagement with ABC Holdings. Six months later, Mary informs Steve that ABC Holdings is ready to perform its CMMC Level 2 assessment. Steve jumps at the opportunity and convinces his management at ACME Inc. to assign him as the lead CCA along with two other employees. Which of the following is true about Steve's involvement in ABC Holdings' CMMC assessment?
- A. Steve can participate in the assessment if he did not directly implement any security controls during the preparatory engagement.
- B. Steve has a conflict of interest and should not be involved in officially assessing ABC Holdings.
- C. Since enough time has passed, Steve can remain objective and impartial in the assessment.
- D. Steve can participate in the CMMC assessment for ABC Holdings if they were bound by an NDA during the initial engagement.
正解：B
解説：
Comprehensive and Detailed in Depth Explanation:
The CoPC prohibits CCAs from assessing an OSC they previously consulted for, due to objectivity risks, regardless of NDAs (Option B), time elapsed (Option C), or specific tasks (Option D). Steve's prior role with ABC Holdings creates a COI, making Option A correct.
Extract from Official Document (CoPC):
* Paragraph 2.2 - Objectivity (pg. 5):"Credentialed individuals shall not conduct a certified assessment if they have served as a consultant to prepare the organization for that assessment." References:
CMMC Code of Professional Conduct, Paragraph 2.2.
質問 # 41
An OSC plans to undergo a CMMC Level 2 assessment with your C3PAO firm. As the Lead Assessor, you are collaborating with the OSC to develop the evidence collection approach for Phase 1. The OSC proposes conducting most interviews virtually due to geographically dispersed employees. You are responsible for defining the evidence collection methods for artifacts, interviews, tests or demonstrations, and information requests. Additionally, you must determine how virtual data collection will be managed, including security protocols for CUI and FCI. Which of the following is the most appropriate approach for artifact collection in this scenario?
- A. Conduct an on-site visit to review paper and electronic artifacts.
- B. Use a combination of virtual document sharing and a limited on-site visit.
- C. Rely solely on information requests sent via email to relevant OSC personnel.
- D. Request the OSC to upload all relevant documents to a secure cloud storage platform.
正解：B
解説：
Comprehensive and Detailed in Depth Explanation:
The CAP allows virtual collection but requires on-site validation for certain practices, making Option A the balanced approach. Option B (full on-site) ignores virtual feasibility. Option C (cloud upload) lacks on-site verification. Option D (email only) is insecure for CUI/FCI.
Extract from Official Document (CAP v1.0):
* Section 1.6.3 - Virtual Data Collection (pg. 21):"Use a combination of virtual document sharing and limited on-site visits for artifact collection, especially for practices requiring physical observation." References:
CMMC Assessment Process (CAP) v1.0, Section 1.6.3.
質問 # 42
......
合格させるCyber AB CMMC-CCA試験最速合格にはFast2test：https://jp.fast2test.com/CMMC-CCA-premium-file.html
準備CMMC-CCA問題解答でCMMC-CCA試験問題集：https://drive.google.com/open?id=1Cqw_OhYdT20fbmCy4YmPNFA3WCpgeCcY