Identify and Apply Knowledge of the Guiding Principles and Practices of the CMMC-AB Code of Professional Conduct (CoPC)/ISO/IEC/DOW Requirements CCP Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A CMMC assessor is also a volunteer for a non-profit organization that provides cybersecurity training to small businesses. The non-profit has received funding from a defense contractor that the assessor is scheduled to assess. The assessor's volunteer role is unrelated to the contractor's CMMC assessment. What is the most appropriate action for the assessor to take?

   • AProceed with the assessment because the volunteer role is unrelated to the assessment and the funding is indirect.
   • BDisclose the volunteer role and the funding relationship to the C3PAO and the contractor.
   • CProceed with the assessment but do not mention the volunteer role to avoid any unnecessary complications.
   • DRecuse themselves from the assessment to avoid any appearance of a conflict of interest.
   Reveal Solution Discussion Select an answer first
2. 2expert · medium

   A CMMC assessor is conducting an assessment for a contractor that has recently experienced a data breach. The contractor's management is pressuring the assessor to downplay the severity of the breach in the assessment report to avoid negative publicity. What should the assessor do, considering the CoPC guiding principles?

   • ASuggest the contractor hire a public relations firm to manage the negative publicity.
   • BReport the contractor's pressure to the CMMC-AB immediately.
   • CAgree to downplay the breach in the report to maintain a good relationship with the contractor.
   • DRefuse to alter the assessment findings and document the breach accurately, explaining the security implications to the contractor.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During a CMMC assessment, a consultant discovers that the organization being assessed is a close personal friend's company. What is the most appropriate action according to the CoPC?

   • AContinue the assessment but ask a colleague to review your findings
   • BProceed with the assessment as long as you remain objective
   • CProceed with the assessment and disclose the relationship to the client
   • DRecuse yourself from the assessment and report the conflict to the appropriate authority
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which statement best describes the relationship between the CoPC, ISO/IEC standards, and the DOW in guiding CMMC professionals?

   • AThey are complementary frameworks that together define the ethical and professional obligations of CMMC professionals
   • BThey are conflicting requirements that professionals must choose between
   • CThey are independent frameworks that apply to different types of CMMC professionals
   • DThey are optional guidelines that professionals may follow at their discretion
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A CMMC assessor is conducting an assessment and discovers that the contractor has implemented a control in a way that is not fully compliant with the CMMC requirements, but the contractor has a documented compensating control that mitigates the risk. What should the assessor do?

   • ASuggest the contractor implement the exact control as specified in the CMMC requirements.
   • BMark the control as non-compliant because it does not meet the exact requirement.
   • CEvaluate the compensating control and document the assessment finding accordingly.
   • DReport the contractor to the CMMC-AB for non-compliance.
   Reveal Solution Discussion Select an answer first