A small manufacturing company plans to undergo a CMMC assessment and needs to validate its scope. The company uses a cloud-based customer relationship management (CRM) system hosted by an external provider to store and process customer information, including FCI and CUI. Which of the following components should the company include in the scope of their CMMC assessment?

• A.The company's internal servers and client computers, but not the cloud-based CRM system or the external service provider.
• B.Only the cloud-based CRM system.
• C.The cloud-based CRM system and the external service provider's (ESP's) systems should be included in the assessment scope.
• D.Only the external service provider's systems.

Comment: *

Name: *

Email: *

Verification: *

During an assessment, it is uncovered that a CCA worked as a consultant for the OSC through their RPO.
Unfortunately, the CCA didn't disclose this when their C3PAO appointed them to participate in the assessment. Did the CCA behave professionally? If not, what issues are likely to arise?

• A.Yes, the CCA behaved professionally.
• B.No, lack of objectivity.
• C.No, assessor bias.
• D.No, breach of confidentiality.

Comment: *

Name: *

Email: *

Verification: *

You are a CCA working with an OSC that outsources some of its IT operations to a third-party service provider. The service provider has access to the OSC's networks and systems that handle FCI and CUI.
During the scoping process, you need to determine if the OSC should flow down CMMC requirements to this third-party service provider. In this scenario, when should the OSCflow down CMMC requirements to the third-party service provider?

• A.The OSC should only flow down CMMC requirements if explicitly stated in the contract with the third- party service provider.
• B.The OSC should flow down CMMC requirements to the third-party service provider since they have access to the FCI/CUI environment and can directly or indirectly influence it.
• C.The OSC should never flow down CMMC requirements to third-party service providers.
• D.The OSC should flow down CMMC requirements to the third-party service provider only if they handle CUI but not FCI.

Comment: *

Name: *

Email: *

Verification: *

You are a Lead Assessor on a CMMC Assessment Team preparing for an upcoming assessment. You have received the final assessment scope and supporting documentation from the OSC. What should you do next?

• A.Determine the feasibility of conducting the assessment.
• B.Immediately begin the assessment based on the provided scope and documentation.
• C.Submit the assessment scope and documentation to the C3PAO for approval.
• D.Verify that the assessment team members are familiar with the assessment scope, method, plan, and tools.

Comment: *

Name: *

Email: *

Verification: *

You are the Lead Assessor of a C3PAO assessment team conducting a CMMC assessment for an OSC. The CMMC Assessment Guide - Level 2 lists assessment methods and objects that you are expected to use to validate the OSC's implementation. Which of the following is FALSE about the use of assessment methods and objects?

• A.Assessment methods are used to make specific determinations called for in the determination statements
• B.The assessment methods define the nature and extent of the assessor's actions
• C.A CCA must use all the specified assessment methods and objects while conducting the CMMCassessment
• D.The Assessment Team has the discretion to use the assessment methods or objects that best fit a CMMC practice during an assessment

Comment: *

Name: *

Email: *

Verification: *