To develop an assessment contract and establish a scope of work, which organization does an OSC work with?
Correct Answer: C
Under the official CMMC Assessment Process (CAP) v2.0 , the OSC contracts directly with a C3PAO to arrange a Level 2 certification assessment, including the practical scope-of-work elements (timing, logistics, and the terms of performance). CAP v2.0 explicitly states that "The C3PAO shall execute a written contractual agreement for the CMMC Level 2 certification assessment with the OSC" and further clarifies that neither the Cyber AB nor DoD are parties to that contract. Because the C3PAO is the assessment organization that conducts the certification assessment, it is also the entity the OSC coordinates with during the pre-assessment activities that shape the engagement and scope. CAP v2.0 places key Phase 1 responsibilities on the C3PAO/Lead CCA, including validating the OSC's assessment scope against applicable scoping requirements and coordinating access to evidence and personnel needed for Phase 2. By contrast, OUSD provides DoD-level oversight/policy, RPOs and the Cyber AB support the ecosystem, but they do not form the contractual relationship for a specific Level 2 certification assessment. CAP v2.0 is unambiguous that the contract (and any mutually agreed scope-of-work terms) is between the OSC and the C3PAO .
Question 17
A Lead Assessor is performing a CMMC readiness review. The Lead Assessor has already recorded the assessment risk status and the overall assessment feasibility. At MINIMUM, what remaining readiness review criteria should be verified?
Correct Answer: B
Question 18
A CMMC Level 1 Self-Assessment identified an asset in the OSC's facility that does not process, store, or transmit FCI. Which type of asset is this considered?
Correct Answer: C
The Cybersecurity Maturity Model Certification (CMMC) 2.0 framework categorizes assets based on their interaction with Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). In a CMMC Level 1 self-assessment, assets are classified based on whether they process, store, or transmit FCI. Asset Categories as per CMMC 2.0: FCI Assets - These assets process, store, or transmit FCI and must meet CMMC Level 1 security requirements (17 practices from FAR 52.204-21). CUI Assets - These assets handle Controlled Unclassified Information (CUI) and are subject to CMMC Level 2 requirements, aligned with NIST SP 800-171. Specialized Assets - Includes IoT devices, Operational Technology (OT), Government-Furnished Equipment (GFE), and test equipment. These are often categorized separately due to their specific cybersecurity requirements. Out-of-Scope Assets - Assets that do not process, store, or transmit FCI or CUI. These do not require compliance with CMMC practices. Government-Issued Assets - These are assets provided by the government for contract-specific purposes, often requiring compliance based on government policies. Why the Correct Answer is C. Out-of-Scope Assets? The question specifies that the identified asset does not process, store, or transmit FCI. According to CMMC 2.0 guidelines, only assets that handle FCI or CUI are subject to security controls. Assets that are physically located within an OSC's facility but do not interact with FCI or CUI fall into the "Out-of-Scope Assets" category. These assets do not require CMMC-specific cybersecurity controls, as they have no impact on the security of FCI or CUI. Relevant CMMC 2.0 References: CMMC Scoping Guide (Nov 2021) - Defines out-of-scope assets as those that are within an OSC's environment but have no interaction with FCI or CUI. CMMC 2.0 Level 1 Guide - Only requires security controls on FCI assets, meaning assets that do not process, store, or transmit FCI are out of scope. CMMC Assessment Process (CAP) Guide - Identifies the classification of assets in an OSC's environment to determine compliance requirements. Final Justification: Since the asset does not process, store, or transmit FCI, it does not fall under "FCI Assets" or "Specialized Assets." It is also not a government-issued asset. Therefore, the correct classification under CMMC 2.0 is Out- of-Scope Assets (C).
Question 19
As defined in the CMMC-AB Code of Professional Conduct, what term describes any contract between two legal entities?
Correct Answer: D
Question 20
Who makes the final determination of the assessment method used for each practice?
Correct Answer: D
Who Determines the Assessment Method for Each Practice?In aCMMC Level 2 Assessment, theLead Assessorhas thefinal authorityin determining theassessment methodused to evaluate each practice. Key Responsibilities of the Lead Assessor#Ensures theCMMC Assessment Process (CAP) Guideis followed. #Determines whether a practice is evaluated usinginterviews, demonstrations, or document reviews. #Directs theCertified CMMC Professionals (CCPs)and other assessors on themethodologyfor gathering evidence. #Works under aCertified Third-Party Assessment Organization (C3PAO)to ensure proper assessment execution. * CCP (Option A) assists in the assessment but does not make final decisionson methods. * OSC (Option B) is the Organization Seeking Certification, and they do not control assessment methodology. * Site Manager (Option C) may coordinate logistics but has no authority over assessment decisions. Why "Lead Assessor" is Correct?Breakdown of Answer ChoicesOption Description Correct? A: CCP #Incorrect-A CCPassistsbut doesnot determine assessment methods. B: OSC #Incorrect-The OSC is beingassessedand does not decide assessment methods. C: Site Manager #Incorrect-The Site Manager handles logistics butdoes not control assessment methods. D: Lead Assessor #Correct - The Lead Assessor has the final say on the assessment method used. * CMMC Assessment Process Guide (CAP)- Defines theLead Assessor's rolein determining assessment methods. Official References from CMMC 2.0 DocumentationFinal Verification and ConclusionThe correct answer isD. Lead Assessor, as they havefinal decision-making authority over the assessment methodology.
