CCA CCA Assessment Planning & Scoping 2

Question 1

Which CMMC assessment guide provides the authoritative criteria used by C3PAOs and CCAs during assessments?

Accepted Answer

CMMC Assessment Guide Level 2

Answer

NIST SP 800-171

Answer

DFARS 252.204-7012

Answer

DoD CUI Registry

Question 2

What does the term 'OSC' refer to in the context of CMMC assessments?

Accepted Answer

Organization Seeking Certification

Answer

Operations Security Coordinator

Answer

Oversight and Surveillance Committee

Answer

Official Security Counsel

Question 3

During assessment scoping, what role does the System Security Plan (SSP) play?

Accepted Answer

It provides a description of the system boundary, components, and implemented security controls

Answer

It replaces the need for an assessment plan

Answer

It serves as the final assessment report

Answer

It is submitted to CMMC-AB for review before the assessment

Question 4

What is the minimum number of assessors required for a CMMC Level 2 certification assessment conducted by a C3PAO?

Accepted Answer

A team of at least two CCAs

Answer

One CCA acting independently

Answer

Three CCAs plus a Certified CMMC Professional

Answer

One CCA and one CMMC Registered Practitioner

Question 5

What is a 'gap analysis' in the context of CMMC assessment planning?

Accepted Answer

A pre-assessment review identifying where an OSC does not yet meet CMMC requirements

Answer

A final compliance determination issued by the CMMC-AB

Answer

A network vulnerability scan performed during fieldwork

Answer

A review of contractor invoices for missing line items

Question 6

Which factor is most important when determining if a cloud service provider falls within an OSC's CMMC assessment scope?

Accepted Answer

Whether CUI is stored, processed, or transmitted within the CSP environment

Answer

Whether the CSP is FedRAMP authorized

Answer

Whether the CSP has a signed NDA with the OSC

Answer

Whether the CSP is a US-based company