CCA Compliance & Reporting 2

Question 1

Under CMMC 2.0, which federal regulation mandates that defense contractors protect Controlled Unclassified Information (CUI)?

Accepted Answer

DFARS 252.204-7012

Answer

DFARS 252.204-7012 is the key clause requiring defense contractors to safeguard covered defense information including CUI.

Question 2

When a CMMC Level 2 assessment reveals a practice not fully implemented, what document must the OSC submit to capture remediation plans?

Accepted Answer

Plan of Action and Milestones (POA&M)

Answer

A POA&M documents identified weaknesses and the plan, resources, and timeline for correcting each deficiency.

Question 3

Which CMMC compliance artifact describes how security requirements are implemented across an organization's system boundary?

Accepted Answer

System Security Plan (SSP)

Answer

The SSP documents the system boundary, how each security requirement is met, and the roles responsible for implementation.

Question 4

A C3PAO discovers mid-assessment that an OSC intentionally misrepresented their implementation of access control practices. What is the C3PAO's required action?

Accepted Answer

Suspend the assessment and report the misrepresentation to the Cyber AB

Answer

C3PAOs must report intentional misrepresentation to the Cyber AB, as this constitutes a violation of assessment integrity.

Question 5

What is the maximum timeframe an OSC has under CMMC 2.0 to resolve a POA&M item before it causes assessment failure at Level 2?

Accepted Answer

180 days

Answer

Under CMMC 2.0 rules, POA&M items must be closed within 180 days of a conditional certification being awarded.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA Compliance & Reporting 2