CCP Role Selection During Phase 1 (Plan and Prepare) CCP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization is preparing for a CMMC Level 2 assessment and has a complex environment with multiple business units, each with its own SSP. During Phase 1, the CCP is asked to help define the assessment scope. The organization wants to exclude a business unit that handles only publicly available data. What should the CCP do?

   • AWork with the organization and Lead Assessor to verify that the business unit truly handles no CMMC data before excluding it.
   • BInclude the business unit but only assess its public data handling controls.
   • CExclude the business unit immediately because the organization stated it handles public data.
   • DRecommend including the business unit in the scope because all business units must be assessed.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A CCP is assigned to a CMMC Level 2 assessment for a defense contractor that uses a hybrid environment with on-premises file servers and an AWS cloud tenant. During Phase 1, the CCP is reviewing the organization's System Security Plan (SSP) and notices that the asset inventory lists several cloud-based virtual machines but does not specify which CMMC assets are in scope. What is the CCP's most appropriate action during Phase 1?

   • AProceed with the assessment plan assuming all cloud assets are out of scope because they are not listed in the SSP.
   • BDocument the gap in the final assessment report and mark the cloud assets as non-compliant.
   • CAsk the Lead Assessor to remove the cloud assets from the assessment scope to simplify the process.
   • DWork with the organization to clarify the asset inventory and identify which cloud and on-premises assets are in scope for the assessment.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which task is outside the CCP's scope during Phase 1 of a CMMC assessment?

   • AReviewing the organization's documentation
   • BIdentifying the assessment scope
   • CMaking the final certification decision
   • DPreparing the assessment plan
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which task falls within the CCP's responsibilities during the Plan and Prepare phase?

   • AApproving the organization's System Security Plan (SSP)
   • BPerforming the final risk assessment for all CMMC practices
   • CIdentifying the scope of the assessment and relevant systems
   • DDetermining the final CMMC level for the organization
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary goal of Phase 1 (Plan and Prepare) in the CMMC assessment lifecycle?

   • ATo implement security controls in the organization's environment
   • BTo issue the final CMMC certification decision
   • CTo collect all evidence and conduct interviews with personnel
   • DTo develop a plan and prepare the assessment team for the assessment
   Reveal Solution Discussion Select an answer first