Identify and Apply Knowledge of the Guiding Principles and Practices of the CMMC-AB Code of Professional Conduct (CoPC)/ISO/IEC/DOW Requirements CCP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   During a CMMC assessment, a contractor offers the assessor a gift card as a token of appreciation for the assessor's time. The assessor is not sure if accepting the gift is appropriate. What should the assessor do, considering the CoPC and DOW requirements?

   • AAccept the gift card but disclose it to the C3PAO after the assessment.
   • BPolitely decline the gift card and explain that accepting gifts could compromise the objectivity of the assessment.
   • CAccept the gift card because it is a small token and does not influence the assessment.
   • DAccept the gift card and donate it to charity to avoid any personal benefit.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A CMMC assessor is also a part-time consultant who helps organizations prepare for CMMC assessments. The assessor is assigned to assess a company that recently used the assessor's consulting services to develop their System Security Plan (SSP). What is the most appropriate action for the assessor to take to comply with the Duties of the Workforce (DOW) and the Code of Professional Conduct?

   • AProceed with the assessment because the consulting work was completed before the assessment began.
   • BProceed with the assessment but note the prior relationship in the assessment report.
   • CAsk the contractor to sign a waiver acknowledging the prior relationship.
   • DDisclose the conflict of interest to the C3PAO and recuse themselves from the assessment if the conflict cannot be mitigated.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   A CMMC professional is reviewing their obligations. Which of the following is a comprehensive source that integrates ethical principles, international standards, and specific duties?

   • AThe CMMC-AB Code of Professional Conduct alone
   • BThe Duties of the Workforce requirements alone
   • CThe ISO/IEC 17024 standard alone
   • DThe combination of the CoPC, ISO/IEC standards, and DOW
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A CMMC assessor is offered a gift by an organization that is about to undergo an assessment. According to the CoPC, what should the assessor do?

   • AAccept the gift if it is a standard business courtesy
   • BAccept the gift and disclose it in the assessment report
   • CAccept the gift if it is of nominal value
   • DDecline the gift and report the offer to the CMMC-AB
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A CMMC assessor is reviewing a contractor's implementation of access control policies. The assessor notices that the contractor's policy allows shared accounts for system administrators, which is contrary to the principle of least privilege. The contractor argues that this is necessary for operational efficiency. What should the assessor do, considering the CoPC guiding principles?

   • ASuggest the contractor implement compensating controls to mitigate the risk of shared accounts.
   • BReport the contractor to the CMMC-AB for non-compliance with the principle of least privilege.
   • CDocument the finding and explain the security implications to the contractor, but do not alter the assessment results based on the contractor's justification.
   • DAccept the contractor's justification because operational efficiency is a legitimate business need.
   Reveal Solution Discussion Select an answer first