A CCA is conducting an interview with an OSC system administrator who admits that a required practice is not implemented because "we don't have the budget for it this year." The CCA notes this in their findings.
What principle of the CoPC does the CCA uphold by documenting this statement without offering advice?

• A.Confidentiality
• B.Professionalism
• C.Objectivity
• D.Information Integrity

Comment: *

Name: *

Email: *

Verification: *

Testing is one assessment method the Lead Assessor may choose depending on the assessment scope and evidence provided by the OSC. During the Plan Phase, the Lead Assessor and OSC POC agree on who the people are that are involved in a particular practice so that it could be tested if determined appropriate. During the discussion, the OSC POC tells the Lead Assessor that the production system is in use and cannot be stopped for the testing to take place but offers a mirrored system for testing. The Lead Assessor decides:

• A.Only to test the processes conducted by the supporting groups
• B.Only to test the Customer Matrices that are available
• C.Not to perform testing as a mirrored system is not an acceptable substitute for the production system
• D.To ask the OSC for evidence that a mirrored system is exactly the same as the production system to conduct testing

Comment: *

Name: *

Email: *

Verification: *

To comply with CMMC requirement IR.L2-3.6.3 - Incident Response Testing, organizations seeking certification (OSCs) must have a plan to regularly test their ability to respond to cyber incidents. This testing ensures that OSCs can effectively identify, contain, and recover from security breaches. An OSC can cite the following evidence artifacts to show compliance with the practice, EXCEPT?

• A.Evidence of regular incident response drills and response time management, recovery testing, and post- incident analysis
• B.Media sanitization plans
• C.Documentation of tabletop exercises and their outcomes
• D.Test documentation, including the scenario, response, findings, and any necessary corrective actions

Comment: *

Name: *

Email: *

Verification: *

An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1 - System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet. What is the Assessment Team's initial finding regarding the OSC's implementation of CM.L2-3.4.1 - System Baselining, and how should it be scored?

• A.NOT MET (Deduct 3 points)
• B.Not Applicable
• C.NOT MET (Deduct 1 point)
• D.NOT MET (Deduct 5 points)

Comment: *

Name: *

Email: *

Verification: *

A company is seeking Level 2 CMMC certification. During the Limited Practice Deficiency Correction Evaluation, the Lead Assessor must decide whether the company can move to a POA&M review. Which condition will result in the Lead Assessor recommending that the OSC's practice deficiencies move to a POA&M review?

• A.A final score below 88
• B.A final score of 110
• C.A final score of 80 or better
• D.A final score of 88/110 or better

Comment: *

Name: *

Email: *

Verification: *