QUESTION 86
Which standard and regulation requirements are the CMMC Model 2.0 based on?

QUESTION 87
How are the Final Recommended Assessment Findings BEST presented?

QUESTION 88
When assessing SI.L2-3.14.6: Monitor communications for attack, the CCA interviews the person responsible for the intrusion detection system and examines relevant policies and procedures for monitoring organizational systems. What would be a possible next step the CCA could conduct to gather sufficient evidence?

QUESTION 89
During the planning phase of the Assessment Process. C3PAO staff are reviewing the various entities associated with an OSC that has requested a CMMC Level 2 Assessment. Which term describes the people, processes, and technology external to the HQ Organization that participate in the assessment but will not receive a CMMC Level unless an enterprise Assessment is conducted?

QUESTION 90
During the assessment process, who is the final interpretation authority for recommended findings?

QUESTION 91
Which domains are a part of a Level 1 Self-Assessment?

QUESTION 92
A company has a government services division and a commercial services division. The government services division interacts exclusively with federal clients and regularly receives FCI. The commercial services division interacts exclusively with non-federal clients and processes only publicly available information. For this company’s CMMC Level 1 Self-Assessment, how should the assets supporting the commercial services division be categorized?

QUESTION 93
After completing a Level 2 Assessment, a C3PAO is preparing to upload the Assessment Results Package to Enterprise Mission Assurance Support Service. Which document MUST be included as part of the final assessment results package?

QUESTION 94
A dedicated local printer is used to print out documents with FCI in an organization. This is considered an FCI Asset Which function BEST describes what the printer does with the FCI?

QUESTION 95
While determining the scope for a company’s CMMC Level 1 Self-Assessment, the contract administrator includes the hosting providers that manage their IT infrastructure. Which asset type BEST describes the third- party organization?

QUESTION 96
Within how many days from the Assessment Final Recommended Findings Brief should the Lead Assessor and Assessment Team Members, if necessary, review the accuracy and validity of (he OSC’s updated POA&M with any accompanying evidence or scheduled collections?

QUESTION 97
Plan of Action defines the clear goal or objective for the plan. What information is generally NOT a part of a plan of action?

QUESTION 98
Which document BEST determines the existence of FCI and/or CUI in scoping an assessment with an OSC?

QUESTION 99
The director of sales, in a meeting, stated that the sales team received feedback on some emails that were sent, stating that the emails were not marked correctly. Which training should the director of sales refer the sales team to regarding information as to how to mark emails?

QUESTION 100
A test or demonstration is being performed for the Assessment Team during an assessment. Which environment MUST the OSC perform this test or demonstration?

QUESTION 101
An Assessment Team is reviewing a practice that is documented and being checked monthly. When reviewing the logs, the practice is only being completed quarterly. During the interviews, the team members say they perform the practice monthly but only document quarterly. Is this sufficient to pass the practice?

QUESTION 102
A CMMC Level 1 Self-Assessment identified an asset in the OSC’s facility that does not process, store, or transmit FCI. Which type of asset is this considered?

QUESTION 103
Who will verify the adequacy and sufficiency of evidence to determine whether the practices and related components for each in-scope Host Unit. Supporting Organization/Unit, or enclave has been met?

QUESTION 104
Which term describes the process of granting or denying specific requests to obtain and use information, related information processing services, and enter specific physical facilities?

QUESTION 105
What are CUI protection responsibilities?

QUESTION 106
An OSC needs to be assessed on RA.L2-3.11.1: Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. What is in scope for a Level 2 assessment of RA.L2-3.11.1?

QUESTION 107
How many domains does the CMMC Model consist of?

QUESTION 108
When scoping the organizational system, the scope of applicability for the cybersecurity CUI practices applies to the components of:

QUESTION 109
Which government agency are DoD contractors required to report breaches of CUI to?

QUESTION 110
Which resource contains authoritative data classifications of CUI?