Secret Quiz 2

CMMC Level 3 encompasess:

• The security requirements for CUI specified in NIST SP 800-171 Rev 2 per DFARS Clause 252.204-7012

• NIST Special Handbook 162
• Security requirements specified in NIST SP 800-172
• The basic safeguarding requirements for FCI specified in FAR Clause 52.504-21

The Lead Assesor is:

• The formally trained individual who is responsible for ensuring Assessment documentation completeness and accuracy
• The individual responsible for reviewing and validating all Assessment packages prior to upload into eMADD
• The most senior representative of a Third-Party assessment organization
• The CMMC Certified Assessor who oversees and manages a dedicated CMMC Assessment Team

Output from system monitoring serves as input to:

• Business intelligence
• Staff performance management
• Management information
• Continuous monitoring and incident response programs

To appropriately scope a CMMC Level 1 self assessment the contractor should consider:

• Customers
• Technology
• Financial Statements
• Annual Turnover

The purpose of NIST Special Publication 800-171 Revision 2 is to provide recommended security requirements for protecting the confidentiality of CUI:

• Where there are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or government wide policy for the CUI category listed in the CUI Registry
• When the CUI is resident in a non-federal system and organization
• When the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf an agency
• All of these

The Cybersecurity Maturity Model Certification (CMMC) framework is:

• The Department of Defense's (DoD) unifying standard for the implementation of privacy measures within the Defense Industrial Base
• The Department of Defense's (DoD) unifying standard for the implementation of cybersecurity measures within the Defense Industrial Base
• The ISO unifying standard for the implementation of cybersecurity measures within the Defense Industrial Base
• The NIST unifying standard for the implementation of cybersecurity measures within the Defense Industrial Base

32 CFR 2002 and DoDI 5200.48 establish policy for:

• The safeguarding, decontrolling, and disposition of FOUO
• The marking, decontrolling, and disposition of SBU
• The designation, safeguarding, dissemination, marking, decontrolling, and disposition of CUI/CDI
• The safeguarding and disposition of FCI

The practice Update Malicious Code Protection means:

• Update malicious code protection mechanisms when new vulnerabilities are discovered
• All of these
• Update malicious code protection mechanisms when an intent of attack is detected
• Update malicious code protection mechanisms when new releases are available

Which of the following are assessment objectives of Manage Physical Access security requirements?

• Physical access devices are managed
• Physical access devices are identified
• Physical access devices are controlled
• All of these

Collaborative computing device include:

• Keyboards
• Networked white boards
• Monitors
• All of these