CMMC CCA Practice Questions - Cyber AB CCA Certified CMMC Assessor Exam

Access More Questions

An OSC has provided evidence for IA.L2-3.5.6 (Identifier Handling) showing their identity management system automatically disables accounts after 90 days of inactivity. The System Security Plan (SSP) defines the inactivity disablement period as 35 days. What is the appropriate finding?

MET because 90 days is within industry standard NOT MET because identifiers are not disabled after the organization-defined period of inactivity documented in the SSP NOT MET because NIST SP 800-171 mandates a universal 30-day inactivity disablement period MET if the organization can demonstrate risk acceptance for the 90-day period without updating the SSP

Correct Answer:

NOT MET because identifiers are not disabled after the organization-defined period of inactivity documented in the SSP

Access more questions from this quiz

Continue to CMMC CCA Practice Questions - Cyber AB CCA Certified CMMC Assessor Exam for more practice questions and the full quiz experience.

Access More Questions