The evidence needed for each practice and/or process is weight for:

1. A. adequacy and sufficiency.
2. B. adequacy and thoroughness.
3. C. sufficiency and thoroughness.
4. D. sufficiency and appropriateness.

Correct Answer: A

The practices in CMMC Level 2 consist of the security requirements specified in:

1. A. NIST SP 800-53
2. B. NIST SP 800-171
3. C. 48 CFR 52.204-21
4. D. DFARS 252.204-7012

Correct Answer: B

When assessing an OSC for CMMC: the Lead Assessor should use the information from the Discussion and Further Discussion sections in each practice because it:

1. A. is normative for an OSC to follow.
2. B. contains examples that an OSC must implement.
3. C. is mandatory and aligns with FAR Clause 52.204-21.
4. D. provides additional information to facilitate the assessment of the practice.

Correct Answer: D

An assessor is collecting affirmations. So far, the assessor has collected interviews, demonstrations, emails, messaging, and presentations. Are these appropriate approaches to collecting affirmations?

1. A. No, emails are not appropriate affirmations.
2. B. No, messaging is not an appropriate affirmation.
3. C. Yes, the affirmations collected by the assessor are all appropriate.
4. D. Yes, the affirmations collected by the assessor are all appropriate, as are screenshots.

Correct Answer: C

Which document specifies the CMMC Level 1 practices that correspond to basic safeguarding requirements?

1. A. NIST SP 800-171
2. B. NIST SP 800-171b
3. C. 48 CFR 52.204-21
4. D. DFARS 252.204-7012

Correct Answer: C