The DoD has awarded a defense contractor a contract to deliver next-gen jet engine parts. The order requires the contractor to submit the blueprints/CAD files within six months, and once they are validated, the contractor submits a production schedule. The contractor indicates that they should be able to deliver the components in three years. Which of the following is true about the dates and schedule of the engine components?

• A.They must be protected under NIST SP 800-171
• B.They must be properly marked and labeled
• C.They are part of the OSC's CUI
• D.They must be protected in accordance with FAR 52.204-21

Comment: *

Name: *

Email: *

Verification: *

You are part of the team conducting a CMMC assessment for an OSC. Because of the sensitive nature of the OSC's technologies, your team signed an NDA. However, you observe one of the Assessment Team members copying something from the OSC's computer systems. You know they don't have permission because the NDA states that the OSC PoC will provide any required material. What should you do in this case?

• A.Inform the OSC of the incident.
• B.Allow them to copy the files.
• C.Approach the team member and remind them of their confidentiality obligations under the CoPC.
• D.Report the team member to the Cyber AB.

Comment: *

Name: *

Email: *

Verification: *

You are a CCA working for a C3PAO that has entered into a contractual agreement to provide CMMC assessment services for an OSC. After validating the evidence, the C3PAO feels that thetask is beyond its capabilities and informs the OSC that it cannot continue with the assessment. The C3PAO cites "insufficient workforce" as the reason. What principle of the CMMC CoPC has the C3PAO broken?

• A.Adherence to Materials and Methods
• B.Information Integrity
• C.Professionalism
• D.Respect for Intellectual Property

Comment: *

Name: *

Email: *

Verification: *

SecureNet is a mid-sized company that designs and manufactures access control systems for government buildings. These systems utilize Internet of Things (IoT) devices embedded within the access control panels for real-time remote monitoring. SecureNet is undergoing a CMMC Level 2 assessment to comply with new government contracting requirements. During the scope validation stage, the Certified CMMC Assessor (CCA) will review SecureNet's proposed assessment scope with the IT team. The scope includes all servers, workstations, and laptops within SecureNet's network. However, there is no mention of the IoT devices within the access control panels. Which of the following asset categories is most likely to encompass the in- scope IoT devices used in SecureNet's access control systems?

• A.Security Protection Asset (SPA)
• B.Specialized Assets
• C.Hardware Assets
• D.Contractor Risk Managed Asset (CRMA)

Comment: *

Name: *

Email: *

Verification: *

You are a CCA who is part of an Assessment Team conducting a CMMC assessment on an aerospace company. While analyzing their network architecture, you realize that it includes a Demilitarized Zone (DMZ) to host their public-facing web servers. What is the primary purpose of a DMZ in a network architecture?

• A.To physically isolate the organization's internal network from the internet
• B.To provide physical security for the organization's public-facing web servers
• C.To allow unrestricted access between the internal network and the internet
• D.To logically isolate the organization's public-facing web servers from the internal network

Comment: *

Name: *

Email: *

Verification: *