The Lead Assessor is ready to complete planning by developing the assessment schedule. The Lead Assessor and the OSC Assessment Official discuss the Assessment Team members.
What MUST be submitted to the Cyber-AB before the assessment?

• A.Individual travel plans
• B.Non-disclosure agreements
• C.Verified NIST SP 800-171 assessor qualifications
• D.Absence of Conflict of Interest and Confirmation Statement

Comment: *

Name: *

Email: *

Verification: *

Both FCI and CUI are stored by an OSC on the same network. Server A contains file shares with FCI, and Server B contains file shares with CUI. The OSC hopes each server would only undergo the assessment for the classification of data it contains. What is the MOST correct assessment situation in this scenario?

• A.Due to the presence of CUI on the network, a Level 2 certification is required for the network
• B.Server A may undergo a Level 1 self-assessment, while Server B must obtain a Level 2 certification
• C.Due to the presence of FCI on the network, only a Level 1 self-assessment is required for the network
• D.The network must be segmented to separate FCI from CUI before any assessments can be conducted

Comment: *

Name: *

Email: *

Verification: *

You are a CCA on an Assessment Team. During a daily checkpoint meeting, the OSC PoC complains that the assessment process is taking too long and asks if some practices can be skipped to speed things up. How should you respond?

• A.Explain that all practices must be assessed as required by the CMMC Assessment Process and cannot be skipped.
• B.Agree to skip non-critical practices to accommodate the OSC's timeline.
• C.Suggest that the OSC discuss the issue with the Lead Assessor to negotiate a reduced scope.
• D.Recommend that the OSC hire additional staff to expedite evidence collection.

Comment: *

Name: *

Email: *

Verification: *

The team is assessing an OSC that uses the cloud for hosting its online services. Which of the following is NOT important for the assessor to consider?

• A.Devices connecting to the system are authorized.
• B.Processes acting on behalf of a user are authenticated.
• C.Users are authorized as a prerequisite to system access.
• D.FIPS encryption is authenticated as a prerequisite to system access.

Comment: *

Name: *

Email: *

Verification: *

You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment. What is the primary focus of the 'Sufficiency' criterion during the evidence verification process in a CMMC assessment?

• A.Confirming the evidence has been reviewed and approved by all stakeholders.
• B.Sufficiency verifies that there is enough evidence to comprehensively assess each practice against the CMMC Assessment scope.
• C.Checking if the evidence includes the latest cybersecurity trends and technologies.
• D.Ensuring the evidence covers a wide range of cybersecurity threats.

Comment: *

Name: *

Email: *

Verification: *