Exam CMMC-CCA Topic 3 Question 91 Discussion
Actual exam question for Cyber AB's CMMC-CCA exam
Question #: 91
Topic #: 3
Question #: 91
Topic #: 3
A contractor has retained you to assess compliance with CMMC practices as part of their triennial review.
During your assessment of the AU domain, you discovered that the contractor has recently installed new nodes and servers on their network infrastructure. To assess their implementation of AU.L2-3.3.7 - Authoritative Time Source, you trigger some events documented to meet AU.L2-3.3.1 - System Auditing across both the new and existing systems, generating audit logs. Upon examining these logs, you notice inconsistencies in the timestamps between newly installed and previously existing nodes. Further investigation reveals that while the contractor has implemented a central Network Time Protocol (NTP) server as the authoritative time source, the new systems are configured to automatically adjust and synchronize their clocks only when the time difference with the NTP server exceeds 30 seconds. Based on this scenario, why is time synchronization with the NTP server necessary, and what is the recommended synchronization time?
During your assessment of the AU domain, you discovered that the contractor has recently installed new nodes and servers on their network infrastructure. To assess their implementation of AU.L2-3.3.7 - Authoritative Time Source, you trigger some events documented to meet AU.L2-3.3.1 - System Auditing across both the new and existing systems, generating audit logs. Upon examining these logs, you notice inconsistencies in the timestamps between newly installed and previously existing nodes. Further investigation reveals that while the contractor has implemented a central Network Time Protocol (NTP) server as the authoritative time source, the new systems are configured to automatically adjust and synchronize their clocks only when the time difference with the NTP server exceeds 30 seconds. Based on this scenario, why is time synchronization with the NTP server necessary, and what is the recommended synchronization time?
Suggested Answer: A Vote an answer
Comprehensive and Detailed In-Depth Explanation:
AU.L2-3.3.7 requires synchronization with an authoritative time source to "generate consistent timestamps for audit records," critical for correlating events across systems. The 30-second threshold causes inconsistencies, failing this requirement. The CMMC guide doesn't specify an exact time, but best practices (e.g., NIST) recommend 1 second for audit log accuracy, ensuring precise event sequencing. Options B, C, and D undermine audit integrity or practicality-user time zones aren't relevant, monthly syncs are too infrequent, and weekly syncs lack precision.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), AU.L2-3.3.7: "Synchronization provides uniformity of timestamps for systems with multiple clocks."
* NIST SP 800-171A, 3.3.7: "Best practice recommends synchronization within 1 second for audit accuracy." Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf
AU.L2-3.3.7 requires synchronization with an authoritative time source to "generate consistent timestamps for audit records," critical for correlating events across systems. The 30-second threshold causes inconsistencies, failing this requirement. The CMMC guide doesn't specify an exact time, but best practices (e.g., NIST) recommend 1 second for audit log accuracy, ensuring precise event sequencing. Options B, C, and D undermine audit integrity or practicality-user time zones aren't relevant, monthly syncs are too infrequent, and weekly syncs lack precision.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), AU.L2-3.3.7: "Synchronization provides uniformity of timestamps for systems with multiple clocks."
* NIST SP 800-171A, 3.3.7: "Best practice recommends synchronization within 1 second for audit accuracy." Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf
by Ternence at May 13, 2026, 09:18 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).