QUESTION 18
During a CMMC readiness review, the OSC proposes that an associated enclave should not be applicable in the scope. Who is responsible for verifying this request?

QUESTION 19
A Lead Assessor is presenting an assessment kickoff and opening briefing. What topic MUST be included?

QUESTION 20
A CCP is part of a CMMC Assessment Team interviewing a subject-matter expert on Access Control (AC) within an OSC. During the interview process, what will the CCP ensure about the information exchanged during the interview?

QUESTION 21
The IT manager is scoping the company’s CMMC Level 1 Self-Assessment. The manager considers which servers, laptops. databases, and applications are used to store, process, or transmit FCI. Which asset type is being considered by the IT manager?

QUESTION 22
An OSC has submitted evidence for an upcoming assessment. The assessor reviews the evidence and determines it is not adequate or sufficient to meet the CMMC practice. What can the assessor do?

QUESTION 23
During the planning phase of the Assessment Process. C3PAO staff are reviewing the various entities associated with an OSC that has requested a CMMC Level 2 Assessment. Which term describes the people, processes, and technology external to the HQ Organization that participate in the assessment but will not receive a CMMC Level unless an enterprise Assessment is conducted?

QUESTION 24
SC.L2-3 13.14: Control and monitor the use of VoIP technologies is marked as NOT APPLICABLE for an OSC’s assessment. How does this affect the assessment scope?

QUESTION 25
Before submitting the assessment package to the Lead Assessor for final review, a CCP decides to review the Media Protection (MP) Level 1 practice evidence to ensure that all media containing FCI are sanitized or destroyed before disposal or release for reuse. After a thorough review, the CCP tells the Lead Assessor that all supporting documents fully reflect the performance of the practice and should be accepted because the evidence is:

QUESTION 26
After completing a Level 2 Assessment, a C3PAO is preparing to upload the Assessment Results Package to Enterprise Mission Assurance Support Service. Which document MUST be included as part of the final assessment results package?

QUESTION 27
A CMMC Assessment is being conducted at an OSC’s HQ. which is a shared workspace in a multi-tenant building. The OSC is renting four offices on the first floor that can be locked individually. The first-floor conference room is shared with other tenants but has been reserved to conduct the assessment. The conference room has a desk with a drawer that does not lock. At the end of the day, an evidence file that had been sent by email is reviewed. What is the BEST way to handle this file?

QUESTION 28
Regarding the Risk Assessment (RA) domain, what should an OSC periodically assess?

QUESTION 29
How many domains does the CMMC Model consist of?

QUESTION 30
When planning an assessment, the Lead Assessor should work with the OSC to select personnel to be interviewed who could:

QUESTION 31
Which NIST SP discusses protecting CUI in nonfederal systems and organizations?

QUESTION 32
Which statement BEST describes a LTP?

QUESTION 33
What is DFARS clause 252.204-7012 required for?

QUESTION 34
An employee is the primary system administrator for an OSC. The employee will be a core part of the assessment, as they perform most of the duties in managing and maintaining the systems. What would the employee be BEST categorized as?

QUESTION 35
When scoping a Level 2 assessment, which document is useful for understanding the process to successfully implement practices required for the various Levels of CMMC?

QUESTION 36
An OSC lead has provided company information, identified that they are seeking CMMC Level 2, stated that they handle FCI. identified stakeholders, and provided assessment logistics. The OSC has provided the company’s cyber hygiene practices that are posted on every workstation, visitor logs, and screenshots of the configuration of their FedRAMP-approved applications. The OSC has not won any DoD government contracts yet but is working on two proposals Based on this information, which statement BEST describes the CMMC Level 2 Assessment requirements?

QUESTION 37
As part of CMMC 2.0, the change to Level 1 Self-Assessments supports “reduced assessment costs” allows all companies at Level 1 (Foundational) to:

QUESTION 38
Recording evidence as adequate is defined as the criteria needed to:

QUESTION 39
The results package for a Level 2 Assessment is being submitted. What MUST a Final Report. CMMC Assessment Results include?

QUESTION 40
Which term describes “the protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to. or modification of information”?

QUESTION 41
A company has a government services division and a commercial services division. The government services division interacts exclusively with federal clients and regularly receives FCI. The commercial services division interacts exclusively with non-federal clients and processes only publicly available information. For this company’s CMMC Level 1 Self-Assessment, how should the assets supporting the commercial services division be categorized?