Evaluate the CMMC Assessment Scope Considerations Based on the CMMC Level 2 Assessment Scoping Guide CCA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A defense contractor uses a cloud-based customer relationship management (CRM) system that stores CUI. The cloud provider is a large commercial provider that does not have a CMMC certification. The contractor has a contract clause requiring the provider to implement security controls equivalent to CMMC Level 2. The contractor wants to include the CRM in scope but is concerned about the provider's lack of certification. What should the assessor recommend?

   • ARecommend the contractor move to a certified provider
   • BExclude the CRM from scope because the provider is not certified
   • CInclude the CRM and rely on the contract clause for the provider's controls
   • DInclude the CRM as a contractor risk managed asset
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is it important to document the assessment scope in a CMMC Level 2 assessment?

   • ATo satisfy a legal requirement that all assessments be published publicly
   • BTo provide a clear record of what was assessed and why, ensuring the assessment is reproducible and defensible
   • CTo provide a marketing document for the organization's security posture
   • DTo replace the need for the System Security Plan (SSP)
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In the context of a CMMC Level 2 assessment, what role does the Assessment Scoping Guide play?

   • AIt provides a mandatory checklist of all security controls that must be implemented
   • BIt assists assessors in identifying the boundaries of the assessment and the assets that must be evaluated
   • CIt replaces the need for the organization's System Security Plan (SSP) during the assessment
   • DIt defines the scoring methodology for CMMC Level 2 assessments
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the responsibility of an external service provider (ESP) that is in scope for a CMMC Level 2 assessment?

   • AThe ESP has no responsibility because it is external to the organization
   • BThe ESP only needs to provide a letter of attestation, not actual security controls
   • CThe ESP is responsible for assessing the organization's compliance
   • DThe ESP must implement all CMMC Level 2 practices on its own systems
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When determining the assessment boundary for CMMC Level 2, which of the following must be considered?

   • AOnly the assets that are physically located on the organization's premises
   • BOnly the assets that are connected to the organization's internal network
   • COnly the assets that are owned by the organization
   • DAll assets, users, and external dependencies that could affect the confidentiality of CUI
   Reveal Solution Discussion Select an answer first