You are a Lead Assessor working with your C3PAO to conduct a CMMC Assessment for an OSC. During the preparation and planning phase, you meet with the OSC's Assessment Official to identify the resources and schedule for the upcoming assessment. Together, you review the OSC's pre- assessment information to estimate the level of effort required. You then collaborate to determine the specific resources needed, including the Assessment Team members, facilities, and any support personnel from the OSC. You also discuss scheduling factors like duration, key activities, and potential constraints. Based on these discussions, you develop a Rough Order of Magnitude (ROM) cost estimate and a proposed daily schedule for the assessment activities. What is your primary responsibility in identifying resources and schedule during Phase 1?
Answer(s): D
Comprehensive and Detailed in DepthThe CAP designates the Lead Assessor's primary Phase 1 responsibility as ensuring all planning requirements (e.g., scope, resources, schedule) are met for the ROM, not finalizing contracts (Option A), selecting team members (Option B, a C3PAO task), or just cost estimation (Option C). Option D encompasses the full scope.Extract from Official Document (CAP v1.0):Section 1.5 Assessment Planning (pg. 16):"The Lead Assessor is responsible for verifying that all planning requirements are met when constructing the ROM estimate."
CMMC Assessment Process (CAP) v1.0, Section 1.5.
You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 Report Recommended Assessment Results. You are preparing to deliver the final recommended findings to the OSC Assessment Official and OSC participants during the Final Findings Briefing. After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?
Answer(s): A
Comprehensive and Detailed in DepthThe CAP requires a CQAP quality review before eMASS submission (Option A). Options B, C, and D are subsequent or optional steps.Extract from Official Document (CAP v1.0):Section 3.2 Report Assessment Results (pg. 32):"The C3PAO CQAP conducts an internal quality review of the Assessment Results Package post-Final Findings Briefing."
CMMC Assessment Process (CAP) v1.0, Section 3.2.
You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment. What is the primary focus of the `Sufficiency' criterion during the evidence verification process in a CMMC assessment?
Answer(s): B
Comprehensive and Detailed in Depth`Sufficiency' ensures there's enough evidence to assess all practices within scope, not stakeholder approval (Option A), trends (Option C), or threat coverage (Option D). Option B is the CAP focus.Extract from Official Document (CAP v1.0):Section 2.1 Evidence Collection (pg. 24):"Sufficiency verifies that there is enough evidence to comprehensively assess each practice against the CMMC Assessment scope."
CMMC Assessment Process (CAP) v1.0, Section 2.1.
During a CMMC assessment, the Lead Assessor requests evidence from the OSC to support their claim that several access control and authentication practices are inherited from their enterprise- level Identity and Access Management (IAM) system. The OSC claims that their parent company manages the IAM system. Which of the following types of evidence would be the most appropriatefor the OSC to demonstrate these inherited practices?
Comprehensive and Detailed in DepthThe CAP requires specific, documented evidence from the entity providing inherited practices (e.g., IAM system) to show compliance with assessment objectives, making Option A correct. Attestations (Option B), verbal confirmations (Option C), and self-assessments (Option D) lack the required specificity and objectivity.Extract from Official Document (CAP v1.0):Section 1.6.1 Access and Verify Evidence (pg. 19):"Evidence from an enterprise from which objectives are inherited must include documented policies, procedures, and system configurations showing that Assessment Objectives are met."
CMMC Assessment Process (CAP) v1.0, Section 1.6.1.
A CCA witnesses another CCA from their C3PAO team flirting with an OSC employee during a social event after completing the assessment. According to the CoPC, what is the most appropriate course of action for the observing CCA?
Comprehensive and Detailed in DepthThe CMMC Code of Professional Conduct (CoPC) prohibits harassment and discrimination in all interactions related to CMMC roles, including post-assessment social events. The observing CCA must act professionally and ethically. Option A (reporting to Cyber AB) escalates prematurely without attempting internal resolution, which the CoPC encourages first. Option C (ignoring) fails to address a potential violation, breaching the CCA's duty to uphold the CoPC. Option D (public confrontation) risks unprofessional escalation. Option B (discreet reminder) aligns with CoPC's emphasis on addressing violations internally and professionally, allowing the offending CCA to correct their behavior while maintaining team integrity.Extract from Official Document (CoPC):Paragraph 3.6(2) Lawful and Ethical Practices (pg. 8):"Refrain from harassment ordiscrimination, sexual or otherwise, in all interactions with individuals encountered in connection with activities related to your role in the CMMC ecosystem."Paragraph 4.1(1)(a) Violation Reporting (pg. 10):"Attempt to rectify the violation with the individual or entity in question prior to reporting."
CMMC Code of Professional Conduct, Paragraphs 3.6(2) and 4.1(1)(a).
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.