A CCA is part of an Assessment Team conducting a CMMC Level 2 assessment. During an interview, an OSC employee admits that a critical security practice is not implemented because "it's too expensive." The CCA responds by suggesting a low-cost alternative solution to implement the practice. What should the CCA have done instead?
Answer(s): A
Comprehensive and Detailed in DepthThe CoPC prohibits offering suggestions during assessments to maintain objectivity, making Option A correct. Options B, C, and D involve inappropriate actions per CoPC.Extract from Official Document (CoPC):Paragraph 3.3(6) Proper Use of Methods (pg. 7):"Do not provide guidance or assistance to OSC personnel during the assessment."
CMMC Code of Professional Conduct, Paragraph 3.3(6).
You are a CCA participating in an assessment exercise for an OSC. You have completed the exercise, and the OSC has hashed the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide. What is the next step for your Assessment Team with respect to the Evidence Artifact Hashes?
Answer(s): B
Comprehensive and Detailed in DepthThe CAP requires the C3PAO to report OSC hashes to CMMC eMASS after hashing, not encrypting (Option A), using a C3PAO cloud (Option C), or doing nothing (Option D). Option B is correct.Extract from Official Document (CAP v1.0):Section 3.5 Archive Assessment Artifacts (pg. 36):"Once hashed, the C3PAO shall report the OSC's hash values in the CMMC eMASS System."
CMMC Assessment Process (CAP) v1.0, Section 3.5.
As a CCA, you were the Lead Assessor for a C3PAO Assessment Team that has just completed a CMMC assessment for an OSC. However, an individual has requested under the FOIA that your C3PAO release the assessment results. As the Lead Assessor, your C3PAO wants to hear your views on this request. What should your recommendation be?
Answer(s): D
Comprehensive and Detailed in DepthThe CoPC protects OSC data unless legally obligated or Cyber AB permits, and FOIA from an individual doesn't override this without a court order. Option D is correct, unlike Options A, B, and C.Extract from Official Document (CoPC):Paragraph 3.2(2) Confidentiality (pg. 6):"Do not disclose confidential assessment results without customer permission or legal obligation."
CMMC Code of Professional Conduct, Paragraph 3.2(2).
You were the Lead Assessor on a team that conducted a CMMC assessment for an OSC that passed and earned a CMMC L2 Certification. Meeting this requirement, the OSC bid on and won a DoD contract. However, a rival company disputes the OSC's CMMC certification status in court. As part of the evidence, the court has directed you to release the assessment results and any evidence you might have relied on to arrive at the assessment results. Based on the CoPC, what action should you take in this situation?
Comprehensive and Detailed in DepthThe CoPC allows disclosure of assessment results when legally obligated, such as by a court order, overriding confidentiality unless Cyber AB permits otherwise. Option A (requiring OSC permission) is superseded by legal obligation. Option C (never releasing) violates the court order. Option D (summary) does not comply fully. Option B is required.Extract from Official Document (CoPC):Paragraph 3.2(1) Confidentiality (pg. 6):"Protect confidential customer data unless permitted in writing by the Cyber AB or required by a legal obligation to disclose the information."
CMMC Code of Professional Conduct, Paragraph 3.2(1).
Jane is a CCA for a leading C3PAO. She is selected to be part of a team of four, headed by James, to assess how Micron Inc., an OSC, has implemented the requirements for a CMMC Level 2 certification. However, she witnesses James striking a deal with Micron's CISO to manipulate some findings to ensure the OSC is certified. What should Jane do?
Comprehensive and Detailed in DepthThe CoPC encourages internal resolution of violations first, making Option B (private clarification) appropriate. Option A (ignoring) neglects duty, Option C (bribery) is unethical, and Option D (DoD CIO) skips internal steps, escalating prematurely.Extract from Official Document (CoPC):Paragraph 4.1(1)(a) Violation Reporting (pg. 10):"Attempt to rectify the violation with the individual in question prior to reporting."
CMMC Code of Professional Conduct, Paragraph 4.1(1)(a).
Post your Comments and Discuss Cyber AB CMMC-CCA exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CMMC-CCA content, but please register or login to continue.