A company has multiple sites with employees at each site that must access the company’s CUI network from their remote locations. The company has set up a single access point for all employees to access the network. What is the MOST significant factor in determining whether the security on this single access point is adequate?
Correct Answer: A
Applicable Requirement: AC.L2-3.1.12 and AC.L2-3.1.14 — ”Monitor and control remote access sessions” and ”Route remote access through managed access control points.”
Why A is Correct: For a single centralized access point, the most critical control is that remote access sessions are properly secured and monitored to prevent unauthorized access to CUI systems. This ensures both confidentiality and integrity of remote connections.
Why Other Options Are Insufficient:
B: Physical access controls protect on-site systems but do not address remote connection security.
C: Documentation alone is not sufficient; actual monitoring and security enforcement are required.
D: Notification procedures relate to incident handling, not adequacy of access point security.
Reference (CCA Official Sources):
NIST SP 800-171 Rev. 2 — AC.L2-3.1.12, AC.L2-3.1.14
NIST SP 800-171A — Remote Access Assessment Objectives
CMMC Assessment Guide — Level 2, Remote Access Guidance
While scoring the evidence for a particular CMMC practice, the Certified Assessor notes that one of the practice objectives is NOT MET, thereby scoring the entire practice as NOT MET. The OSC Assessment Official disagrees with the Certified Assessor’s decision, and they both take the dispute to the Lead Assessor, who is unable to resolve the issue to the OSC’s satisfaction.
How will this dispute be settled?
Correct Answer: D
The CMMC Assessment Process (CAP) specifies that when disputes cannot be resolved by the Lead Assessor, they must be elevated to the C3PAO Official, who has authority to make the final decision.
Extract:
”Unresolved disputes between the OSC and the Assessment Team must be elevated to the C3PAO Official for final resolution.”
Therefore, the C3PAO Official is the final arbiter in such disputes.
An OSC is preparing for assessment. Which item of evidence would show the OSC’s efforts to restrict physical access within the OSC’s environment?
Correct Answer: D
Applicable Requirement: PE.L2-3.10.1 — ”Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.”
Why D is Correct: Documented procedures describing physical access restrictions (badge policies, visitor management, locked server rooms, guard post orders) serve as primary evidence that access is managed and enforced. Assessors can then corroborate via interviews and observation.
Why Other Options Are Insufficient:
A (VPN configuration): Relates to remote logical access, not physical security.
B (Switch configs): Technical network controls, not physical access.
C (Architecture drawings): Show logical/system design, not physical entry restrictions.
Reference (CCA Official Sources):
NIST SP 800-171 Rev. 2 — PE.L2-3.10.1
NIST SP 800-171A — PE.L2-3.10.1 Assessment Objectives
CMMC Assessment Guide — Level 2 — Physical Protection Evidence Guidance
An OSC has a testing laboratory. The lab has several pieces of equipment, including a workstation that is used to analyze test information collected from the test equipment. All equipment is on the same VLAN that is part of the certification assessment. The OSC claims that the workstation is part of the test equipment (Specialized Asset) and only needs to be addressed under risk-based security policies. However, the OSC states that the data analysis output is CUI. What is the assessor’s BEST response?
Correct Answer: A
If an asset processes or generates CUI, it is a CUI Asset by definition, regardless of whether it is also part of a test lab or claimed as a Specialized Asset. Specialized Asset handling applies only when the asset does not process, store, or transmit CUI. Since the workstation outputs CUI, it must be assessed fully against CMMC practices.
Exact extracts:
”CUI Assets are those that process, store, or transmit CUI.”
”Specialized Assets… do not process, store, or transmit CUI.”
”If a Specialized Asset processes CUI, it must be categorized as a CUI Asset and is assessed against all applicable practices.”
Why the other options are incorrect:
B: The issue is not with the SSP practice; it is with misclassification of an asset.
C/D: Risk-based treatment applies only to Specialized Assets without CUI, which is not the case here.
CMMC Level 2 Scoping Guide — Specialized Assets; CUI Asset definitions.
A Lead Assessor is preparing to conduct a Level 2 Assessment for an OSC. During the planning phase, the Lead Assessor and OSC have:
Developed evidence collection approach;
Identified the team members, resources, schedules, and logistics;
Identified and managed conflicts of interest;
Gained access to the OSC’s relevant documentation.
Based on the information provided, which would be an additional element to be discussed during the planning phase of the assessment?
Correct Answer: A
During the planning phase, the Lead Assessor must ensure that evidence gaps are identified and documented before assessment execution. This ensures that the OSC is aware of missing or insufficient evidence and can address them prior to final scoring.
Exact Extracts:
CMMC Assessment Guide: ”During planning, assessors and OSC should confirm sufficiency of evidence and identify/document any evidence gaps.”
”The planning phase ensures readiness to proceed with the assessment, including identifying gaps and establishing how they will be addressed.”
Why the other options are not correct:
B: Appeals are addressed post-assessment, not in planning.
C: Assessment costs are agreed upon contractually, not part of the assessment planning phase.
D: FedRAMP equivalency determination is part of scope validation, not general planning.
CMMC Assessment Guide — Level 2, Version 2.13: Assessment planning activities (pp. 5–8).
Prep2Certsis a premium service offering a comprehensive collection of exam questions and answers for over 1400 certification exams. It is regularly updated and designed to help users pass their certification exams confidently.
Please contact info@Prep2Certs.com and we will provide you with alternative payment options.
You can by Contacting our sales team.