You are conducting a CMMC assessment for a contractor responsible for maintaining a critical supply chain network for the DoD. During the assessment of the Media Protection (MP) domain, you request a review of the contractor's access control documentation, focusing on the management of encryption and decryption keys. The contractor employs a Data Custodian role to manage these keys. However, during interviews, you discover that the Data Analysts and IT Support roles also have access to certain key management functions. When questioned about this practice, the contractor's security team explains that these roles need access for operational continuity and data processing efficiency. Based on this scenario, how would you assess the contractor's compliance with CMMC practice MP.L2-3.8.2-Key Management?
Practise this Certified CMMC Assessor (CCA) Exam question free, then download the PDF, watch the video walkthrough, or unlock timed mock exams for the full web bank.
APartially Met - While only the Data Custodian role should have access, current roles need better definition.
BNot Applicable - This practice does not apply to the contractor's operational environment.
CNot Met - The contractor allows multiple roles access to key management functions, violating the restriction to a limited subset of defined privileged users.
DMet - The contractor has defined roles for key management as required by CMMC.
✓ Correct answer: C. Not Met - The contractor allows multiple roles access to key management functions, violating the restriction to a limited subset of defined privileged users.Answer: Not Met - The contractor grants access to key management functions across various roles, contravening the CMMC requirement to restrict this access to a narrowly defined subset of privileged users. The contractor should limit key management access only to the Data Custodian to comply with CMMC practice MP.L2-3.8.2.
Keep practising. Use the free Certified CMMC Assessor (CCA) Exam PDF, watch the YouTube walkthrough, or unlock all 10 web questions with timed mock exams.
Free practice here. Timed mocks when you are ready.
Study the Certified CMMC Assessor Prep free question explanations, download the PDF, then unlock timed mock exams on the web when you want exam-day practice.
Theory