SC.L2-3 13.14: Control and monitor the use of VoIP technologies is marked as NOT APPLICABLE for an OSC's assessment. How does this affect the assessment scope?

1. A. Any existing telephone system is in scope even if it is not using VoIP technology.
2. B. An error has been made and the Lead Assessor should be contacted to correct the error.
3. C. VoIP technology is within scope, and it uses FlPS-validated encryption, so it does not need to be assessed.
4. D. VoIP technology is not used within scope boundary, so no assessment procedures are specified for this practice.

Correct Answer: D

Which statement BEST describes the requirements for a C3PA0?

1. A. An authorized C3PAO must meet some DoD and all ISO/IEC 17020 requirements.
2. B. An accredited C3PAO must meet all DoD and some ISO/IEC 17020 requirements.
3. C. AC3PAO must be accredited by DoD before being able to conduct assessments.
4. D. A C3PAO must be authorized by CMMC-AB before being able to conduct assessments.

Correct Answer: D

What is the BEST description of the purpose of FAR clause 52 204-21?

1. A. It directs all covered contractors to install the cyber security systems listed in that clause.
2. B. It describes all of the safeguards that contractors must take to secure covered contractor IS.
3. C. It describes the minimum standard of care that contractors must take to secure covered contractor IS.
4. D. It directs covered contractors to obtain CMMC Certification at the level equal to the lowest requirement of their contracts.

Correct Answer: C

An OSC receives an email with "CUI//SP-PRVCY//FED Only" in the body of the message Which organization's website should the OSC go to identify what this marking means?

1. A. NARA
2. B. CMMC-AB
3. C. DoD Contractors FAQ page
4. D. DoD 239.7601 Definitions page

Correct Answer: A

As defined in the CMMC-AB Code of Professional Conduct, what term describes any contract between two legal entities?

1. A. Union
2. B. Accord
3. C. Alliance
4. D. Agreement

Correct Answer: D