When an OSC requests an assessment by a C3PAO, who selects the Lead Assessor for the assessment?

1. A. OSC
2. B. C3PAO
3. C. C3PAO and OSC
4. D. OSC and Lead Assessor

Correct Answer: B

A contractor stores security policies, system configuration files, and audit logs in a centralized file repository for later review. According to CMMC terminology, the file repository is being used to:

1. A. protect CUI.
2. B. transmit CUI.
3. C. store CUI.
4. D. generate CUI

Correct Answer: C

A client uses an external cloud-based service to store, process, or transmit data that is reasonably believed to qualify as CUI. According to DFARS clause 252.204-7012. what set of established security requirements MUST that cloud provider meet?

1. A. FedRAMP Low
2. B. FedRAMP Moderate
3. C. FedRAMP High
4. D. FedRAMP Secure

Correct Answer: B

A company is working with a CCP from a contracted CMMC consulting company. The CCP is asked where the Host Unit is required to document FCI and CUI for a CMMC Assessment. How should the CCP respond?

1. A. "In the SS
2. B. within the asset inventory, and in the network diagranY'
3. C. "Within the hardware inventory, data (low diagram, and in the network diagram"
4. D. "Within the asset inventory, in the proposal response, and in the network diagram"
5. E. "In the network diagram, in the SS
6. F. within the base inventory, and in the proposal response'"

Correct Answer: A

Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1, Guidelines for Media Sanitation?

1. A. Clear, purge, destroy
2. B. Clear, redact, destroy
3. C. Clear, overwrite, purge
4. D. Clear, overwrite, destroy

Correct Answer: A