SC.L2-3 13.14: Control and monitor the use of VoIP technologies is marked as NOT APPLICABLE for an OSC's assessment. How does this affect the assessment scope?
Correct Answer: D
* TheCMMC 2.0 Level 2requirementSC.L2-3.13.14comes fromNIST SP 800-171, Security Requirement 3.13.14, which mandates that organizations mustcontrol and monitor the use of VoIP (Voice over Internet Protocol) technologiesif used within their system boundary. * If a systemdoes not use VoIP technology, then this control isNot Applicable (N/A)because there is nothing to assess. * When a requirement is marked as Not Applicable (N/A), it means the OSC does not use the technology or process covered by that controlwithin its assessment boundary. * No assessment procedures are neededsince there is no VoIP system to evaluate. * Option A (Existing telephone system in scope)is incorrect becausetraditional (non-VoIP) telephone systems are not covered by SC.L2-3.13.14-only VoIP is within scope. * Option B (Error, contact the Lead Assessor)is incorrect because markingSC.L2-3.13.14 as N/A is valid if VoIP is not used. This is not an error. * Option C (VoIP in scope but using FIPS-validated encryption, so it doesn't need to be assessed)is incorrect becauseeven if VoIP uses FIPS-validated encryption, the control would still need to be assessed to ensure monitoring and usage control are in place. * CMMC 2.0 Level 2 Assessment Guide - SC.L2-3.13.14 * NIST SP 800-171, Security Requirement 3.13.14 * CMMC Scoping Guidance - Determining Not Applicable (N/A) Practices Understanding SC.L2-3.13.14 - Control and Monitor the Use of VoIP TechnologiesWhy Option D is CorrectOfficial CMMC Documentation ReferencesFinal VerificationIfVoIP is not used within the OSC's system boundary, the control does not require assessment, making Option D the correct answer.
Question 93
What is the MOST common purpose of assessment procedures?
Correct Answer: A
Theprimary goal of CMMC assessment proceduresis to determine whether anOrganization Seeking Certification (OSC)complies with the cybersecurity controls required for its certification level. Themost common purpose of assessment procedures is to obtain evidencethat verifies an organization has properly implemented security practices. Why "A. Obtain Evidence" is Correct? CMMC Assessments Require Evidence Collection TheCMMC Assessment Process (CAP) Guideoutlines that assessors must use three methods to verify compliance: Examine- Reviewing documentation, policies, and system configurations. Interview- Speaking with personnel to confirm understanding and execution. Test- Validating controls through operational or technical tests. All these methods involve obtaining evidenceto support whether a security requirement has been met. Alignment with NIST SP 800-171A CMMC Level 2 assessments follow NIST SP 800-171A, which is designed for evidence-based verification. Assessors rely on documented artifacts, system logs, configurations, and personnel testimony as evidence of compliance. Why Other Answers Are Incorrect? B). Define level of effort (Incorrect) Thelevel of effortrefers to the time and resources needed for an assessment, but this is aplanningactivity, not the primary goal of an assessment. C). Determine information flow (Incorrect) While understandinginformation flowis important for security controls likedata protection and access control, themain purpose of an assessment is to gather evidence-not to determine information flow itself. D). Determine value of hardware and software (Incorrect) Asset valuation may be part of an organization's risk management process, but CMMC assessmentsdo not focus on determining hardware or software value. Conclusion The correct answer isA. Obtain evidence, as theCMMC assessment process is evidence-drivento verify compliance with security controls. References: CMMC Assessment Process (CAP) Guide NIST SP 800-171A (Assessment Procedures for CUI) DoD CMMC 2.0 Scoping and Assessment Guidelines
Question 94
Which statement BEST describes the key references a Lead Assessor should refer to and use the:
Correct Answer: D
Key References for a Lead Assessor in a CMMC AssessmentALead Assessorconducting aCMMC assessmentmust rely onofficial CMMC guidance documentsto evaluate whether anOrganization Seeking Certification (OSC)meets the required cybersecurity practices. * TheCMMC Assessment Guideprovidesdetailed descriptionsof eachpractice and processat the specificCMMC level being assessed. * It defines:#Theassessment objectivesfor each practice.#Therequired evidencefor compliance. #Thescoring criteriato determine if a practice isMET or NOT MET. Most Relevant Reference: CMMC Assessment Guide * A. DoD adequate security checklist for covered defense information # Incorrect * TheDoD adequate security checklistis related toDFARS 252.204-7012 compliance, butCMMC assessmentsfollow theCMMC Assessment Guide. * B. CMMC Model Overview as it provides assessment methods and objects # Incorrect * TheCMMC Model Overviewprovideshigh-level guidance, butdoes not contain specific assessment criteria. * C. Safeguarding requirements from FAR Clause 52.204-21 for a Level 2 Assessment # Incorrect * FAR 52.204-21is relevant toCMMC Level 1 (FCI protection), butCMMC Level 2 follows NIST SP 800-171and requiresCMMC Assessment Guidesfor validation. * D. Published CMMC Assessment Guide practice descriptions for the desired certification level # Correct * TheCMMC Assessment Guideis theofficial documentused to determine if anOSC meets the required security practices for certification. Why is the Correct Answer "D. Published CMMC Assessment Guide practice descriptions for the desired certification level"? * CMMC Assessment Process (CAP) Document * Specifies thatLead Assessors must use the CMMC Assessment Guidefor official scoring. * CMMC Assessment Guide for Level 1 & Level 2 * Providesdetailed descriptions, assessment methods, and scoring criteriafor each practice. * CMMC-AB Guidance for Certified Third-Party Assessment Organizations (C3PAOs) * Confirms thatCMMC assessments must follow the Assessment Guide, not general DoD security policies. CMMC 2.0 References Supporting This Answer: Final Answer:#D. Published CMMC Assessment Guide practice descriptions for the desired certification level.
Question 95
Within what amount of time MUST convictions, guilty pleas, or no contest pleas to crimes of fraud, larceny, embezzlement, misappropriation of funds, misrepresentation, perjury, false swearing, conspiracy to conceal, or a similar offense in any legal proceeding, civil or criminal, whether or not connected with activities that relate to carrying out a Lead Assessor role, be reported to the CMMC Accreditation Body?
Correct Answer: B
The correct answer is B , 30 days. The official CMMC Program rule at 32 CFR Part 170 , Subpart C, requires CMMC ecosystem members to report certain criminal matters to the Accreditation Body within 30 days . The rule specifically includes convictions, guilty pleas, and no contest pleas involving crimes such as fraud, larceny, embezzlement, misappropriation of funds, misrepresentation, perjury, false swearing, conspiracy to conceal, or similar offenses in civil or criminal legal proceedings. This requirement applies whether or not the offense is directly connected to the individual's CMMC ecosystem role. This requirement is important because CMMC ecosystem roles, including Lead Assessors, depend on trustworthiness, professional integrity, impartiality, and reliability. A Lead Assessor participates in activities that may affect whether an OSC receives a CMMC certification, so criminal conduct involving dishonesty or misuse of funds is highly relevant to the integrity of the ecosystem. Option A , 90 days, is incorrect because the reporting window is shorter. Option C , 3 days, and option D , 7 days, are also incorrect because they do not match the official 30-day reporting requirement. Although older training materials may use the term "CMMC-AB," the current terminology commonly refers to the Accreditation Body or The Cyber AB. The required reporting period remains 30 days .
