An OSC seeking Level 2 certification is working with an ESP. The organization is trying to determine if the ESP is considered within the assessment and is reviewing the Service Level Agreement (SLA) between the organization and the ESP. Which SLA component should be taken into consideration to determine if the ESP is within the assessment scope?

• A.Services
• B.Intervals
• C.Penalties
• D.Measurements

Comment: *

Name: *

Email: *

Verification: *

During scoping discussions with a Lead Assessor, the OSC mentions that there are several connected systems within the organization's network. How should the Lead Assessor consider connected systems in the scoping of the CMMC assessment?

• A.Connected systems are never in scope unless specifically requested by the OSC.
• B.Connected systems are only in scope if they directly transmit FCI and/or CUI.
• C.Only internally connected systems directly handling FCI and/or CUI are in scope.
• D.Connected systems would be considered in scope for the assessment if the systems could impact the security of the CUI (or FCI) environment or if they store, process, or transmit CUI (or FCI) within the organization's network.

Comment: *

Name: *

Email: *

Verification: *

A CCA is offered a significant discount on cybersecurity software from a vendor whose productthey will be evaluating during a CMMC assessment. How should the CCA handle this situation according to the CoPC's conflict of interest principle?

• A.Inform the vendor that they can accept such offers only after the CMMC assessment is done.
• B.Accept the discount and disclose it to the C3PAO for transparency.
• C.Decline the discount to avoid any appearance of a conflict.
• D.Recommend the software to the OSC during the assessment, highlighting its value proposition.

Comment: *

Name: *

Email: *

Verification: *

To meet AC.L2-3.1.5: Least Privilege, the following procedure is established:
* All employees are given a basic (non-privileged) user account.
* System Administrators are given a separate System Administrator account.
* Database Administrators are given a separate Database Administrator account.
Which steps should be added to BEST meet all of the standards for least privilege?

• A.4. Database Administrators use their Database Administrator accounts to perform privileged functions.
  5. All users use their basic account for non-privileged functions.
• B.4. Database Administrators use their Database Administrator accounts to perform privileged functions.
  5. Non-privileged users use their basic account for non-privileged functions.
• C.4. Database Administrators use the System Administrator accounts to perform privileged functions.
  5. All other users use their basic account for all authorized functions.
• D.4. Database Administrators use the System Administrator accounts to perform privileged functions.
  5. Non-privileged users use their basic account for all authorized functions.

Comment: *

Name: *

Email: *

Verification: *

John, a CCA, has been assigned by his C3PAO to conduct a CMMC assessment for an OSC. During the assessment, John notices that the OSC's security practices leave much to be desired. After speaking with the OSC's IT staff, John offers to connect them with a vendor he knows who sells a vulnerability management tool that could address some of their weaknesses. According to the CMMC CoPC, which of the following best describes John's actions?

• A.John acted appropriately by trying to help the OSC improve its security posture.
• B.John did not show respect for intellectual property.
• C.John's actions were deemed acceptable since he did not directly profit from connecting the OSC with the vendor.
• D.John violated the principles of professionalism and objectivity by soliciting business for a third-party vendor while serving on the Assessment Team.

Comment: *

Name: *

Email: *

Verification: *