A CCA is assessing the implementation of the Incident Reporting practice. To validate the control, what MUST the CCA ensure about the OSC?

• A. Law enforcement officials are automatically notified during an incident
• B. Incidents are tracked and documented
• C. Incident sources are configured and tuned
• D. Forensic investigations are performed to determine the impact of the incident

While conducting an assessment, an assessor is determining if privileged accounts are used for non-privileged functions. While interviewing a user with a privileged account, the assessor should ask if the person interviewed:

• A. Knows which other users have privileged accounts
• B. Uses their privileged account to research vulnerabilities on the Internet
• C. Is knowledgeable of role-based access control privileges
• D. Can show how IT staff provision privileged and non-privileged accounts

The client has a Supervisory Control and Data Acquisition (SCADA) system as OT to be evaluated as part of its assessment. In reviewing network architecture and conducting interviews, the assessor determines that a firewall separates the SCADA system from the client's enterprise network and that CUI is not processed by the SCADA system. Based on this information, what is an appropriate outcome?

• A. The assessor includes all systems identified by the client as part of the assessment
• B. The assessor determines that all Specialized Assets are within the scope of the assessment
• C. The assessor determines the SCADA system is out-of-scope for the assessment
• D. The assessor includes the OT within the assessment

An OSC outsources all of its security incident and event monitoring work to a third-party SOC. Additionally, the OSC utilizes a cloud-hosted antivirus (AV) system to fulfill the requirement of having virus protection without hosting additional servers on-site.
During the scoping discussion, both the SOC and AV should be listed as what type of asset?

• A. They are Out-of-Scope Assets due to being fully hosted/operated by third parties.
• B. They are Contractor Risk Managed Assets because they are not physically or logically isolated from CUI assets.
• C. They are Security Protection Assets due to their performance of security functions.
• D. They are CUI Assets due to their operation within a CUI network.