Identify and Apply Knowledge of the Guiding Principles and Practices of the CMMC-AB Code of Professional Conduct (CoPC)/ISO/IEC/DOW Requirements CCP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which ISO/IEC standard specifies requirements for bodies certifying persons, and is relevant to the CMMC-AB's certification of professionals?

   • AISO/IEC 9001
   • BISO/IEC 17024
   • CISO/IEC 17020
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A CMMC assessment organization (C3PAO) is developing its internal quality management procedures. The lead assessor wants to ensure the procedures align with the requirements of ISO/IEC 17020, which is referenced in the CMMC ecosystem. Which of the following practices is most directly aligned with ISO/IEC 17020 requirements?

   • AEnsuring that all assessment reports are reviewed by a senior assessor before release.
   • BRequiring all assessors to hold a current CMMC Certified Professional (CCP) certification.
   • CMaintaining a list of approved subcontractors who can perform assessments on behalf of the C3PAO.
   • DImplementing a documented process for handling complaints and appeals from assessed organizations.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a core guiding principle of the CMMC-AB Code of Professional Conduct?

   • APrioritizing client requests over regulatory requirements
   • BConfidentiality
   • CMaximizing billable hours
   • DEnsuring the assessment is completed as quickly as possible
   Reveal Solution Discussion Select an answer first
5. 14expert · medium

   A CMMC assessor is assigned to a Level 2 assessment for a contractor that is also a client of the assessor's spouse, who works as a cybersecurity consultant. The assessor's spouse has provided consulting services to the contractor in the past, but not for CMMC preparation. The assessor has no direct involvement in the spouse's work. The C3PAO is aware of the relationship and has assigned the assessor to the assessment. What is the most appropriate action for the assessor to take?

   • ADisclose the potential conflict of interest to the C3PAO and request a different assignment if the conflict cannot be mitigated.
   • BAsk the contractor if they are comfortable with the assessor conducting the assessment.
   • CProceed with the assessment but avoid any discussion of the spouse's consulting work with the contractor.
   • DProceed with the assessment because the spouse's work is unrelated to CMMC and the C3PAO has already approved the assignment.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A CMMC assessment organization (C3PAO) is preparing for its accreditation audit. The lead assessor is reviewing the organization's policies to ensure they align with ISO/IEC 17020 requirements. Which of the following policies is most directly required by ISO/IEC 17020?

   • AA policy that mandates the use of a specific assessment tool for all assessments.
   • BA policy that requires all assessment reports to be reviewed by a legal counsel before release.
   • CA policy that ensures the C3PAO's assessment activities are independent from any consulting services it may offer.
   • DA policy that requires all assessors to have at least five years of experience in cybersecurity.
   Reveal Solution Discussion Select an answer first