CMMC-CCA Practice Questions

A.  

Documents utilized for review must be in their mailed form

B.  

Documents must be policy, process, and procedure documents

C.  

Training materials reviewed can be in-process as they are for educational purposes

D.  

System-level, network, and data flow diagrams must be completed in draft format

A.  

Data center in another state used by the OSC

B.  

A smoke detector that is connected to the OSC network

C.  

The SIEM tool used by the managed service provider in managing the OSC

D.  

The office where its managed service provider’s management office is located

A.  

Interview personnel with information security responsibilities.

B.  

Interview personnel with application development responsibilities.

C.  

Interview personnel who wrote the configuration management policy.

D.  

Interview personnel with security configuration management responsibilities.

A.  

Handwritten notes from executive committee meetings discussing implementation

B.  

Several years’ worth of saved emails from the executive team approving policies and directing adherence

C.  

A notarized letter from the previous CEO stating that they approved information security policies annually

D.  

Transcribed interviews with new employees discussing their understanding of information security policies

A.  

Treat all data as CUI even if not marked.

B.  

If data are not marked, then they are not CUI.

C.  

Have a procedure for deleting unlabeled data.

D.  

Have a procedure for proper handling of unlabeled data.