CMMC Assessor

Sample question 1

You are the Lead Cybersecurity Maturity Model Certification (CMMC) Certified Assessor (Lead CCA) at Bellwood Assurance Group, a CMMC Third-Party Assessment Organization (C3PAO), scoping a Level 2 certification assessment of Tanager Precision Machining, an Organization Seeking Certification (OSC) that manufactures tooling under a Department of Defense (DoD) contract and processes Controlled Unclassified Information (CUI) in its enterprise resource planning system. Tanager's information technology director tells you the company completed its own internal readiness review last quarter, covering the same system boundary and requirements Bellwood is engaged to assess, and asks whether Bellwood can treat that review as meeting the plan and prepare phase so fieldwork can start next week without Bellwood producing a separate deliverable of its own. Which of the following correctly states what the plan and prepare phase still requires from Bellwood?

1. A.Bellwood can adopt Tanager's internal readiness review as its plan and prepare deliverable, record it in the assessment file, and carry it into the conduct phase's evidence review and interviews, since both documents cover the same system boundary and the same requirements.
2. B.Bellwood still has to independently confirm scope and readiness, complete its own Pre-Assessment Form, obtain a quality assurance review, and upload the form into CMMC eMASS before fieldwork starts. Tanager's internal readiness review can inform that work, but it does not substitute for these C3PAO-only steps, which conclude the plan and prepare phase.
3. C.Because Tanager's internal readiness review already validated the system boundary, Bellwood can limit its phase to confirming interview times, arranging site access, and assigning team members, since scope validation is a step the OSC completed and the assessment team does not need to repeat it.
4. D.Bellwood should let fieldwork begin next week as Tanager requests, assemble the assessment plan from the notes and interview schedule the team generates during evidence review, obtain its quality review afterward, and upload it before the report phase begins, since the sequence of those steps is not fixed by the assessment process.

Sample question 2

You are a Cybersecurity Maturity Model Certification (CMMC) Certified Assessor (CCA) conducting evidence review for a Level 2 certification assessment of Driftwood Avionics, an Organization Seeking Certification (OSC) that designs engine components under a Department of Defense (DoD) contract and stores Controlled Unclassified Information (CUI) in its engineering document management system. For the requirement covering audit log review, you examine Driftwood's System Security Plan (SSP), which states that administrators review audit logs weekly for anomalous activity. To corroborate that statement, you request the completed sign-off records documenting each week's review for the past eight weeks; only two of the eight weeks have a completed sign-off. The CMMC Certified Professional (CCP) working with you drafts an observation reading, 'Requirement satisfied: audit logs are reviewed weekly per policy,' citing the System Security Plan (SSP) language as sufficient, and asks whether it is ready to move forward. Which of the following is the correct instruction to give?

1. A.Revise the observation to cite both the System Security Plan (SSP) statement and the two completed sign-offs, and record the requirement as satisfied, since the governing document establishes the weekly practice and the completed records confirm that administrators carry out the review procedure it describes.
2. B.Discard the System Security Plan (SSP) description from the observation and record only the sign-off gap found in the sampled records, leaving the determination open, since records of what was actually done carry more weight than a written policy statement, and the plan's description no longer needs to appear once a contradiction turns up.
3. C.Ask the administrator responsible for log review to explain the six weeks that lack a completed sign-off, and if the explanation is credible, record the observation as satisfied based on that interview account, since a firsthand explanation from the person who performs the control can resolve a gap found in sampled documentation.
4. D.Rewrite the observation to record what both sources show: the System Security Plan (SSP) states audit logs are reviewed weekly, and the sampled sign-off records show completed reviews for two of the eight weeks, with no sign-off for the rest. The observation should capture that discrepancy, leaving the determination open until it is resolved.

Sample question 3

You are a Cybersecurity Maturity Model Certification (CMMC) Certified Assessor (CCA) determining the result for the requirement covering authorization of wireless access during a Level 2 certification assessment of Cascade Thermal Systems, an Organization Seeking Certification (OSC) that fabricates heat exchangers under a Department of Defense (DoD) contract and processes Controlled Unclassified Information (CUI) in its manufacturing execution system. Your assessment objectives worksheet for this requirement lists two objectives: wireless access points are identified, and wireless access is authorized before it is allowed. A facility walkthrough, a review of network architecture diagrams, and a wireless site survey all confirm Cascade has no wireless access points anywhere in the CUI environment and no wireless network interfaces enabled on any in-scope system; interviewed staff confirm the facility has never deployed wireless infrastructure. Which of the following correctly states the determination you should make and document?

1. A.Document a NOT APPLICABLE determination for the requirement, citing both objectives and the walkthrough, network diagram review, and site survey evidence showing no wireless access points or enabled wireless interfaces in Cascade's CUI environment. The requirement addresses a technology that does not exist here, so both objectives are recorded as not applicable.
2. B.Document a NOT MET determination for the requirement, citing the absence of any authorization records for wireless access. Since no evidence shows Cascade authorizing wireless connections before allowing them, the objective addressing authorization has not been evidenced as satisfied, regardless of whether wireless access points exist anywhere in the environment.
3. C.Document a MET determination for the requirement, citing the walkthrough, network diagram review, and site survey as evidence. An environment with no wireless access points at all presents no opportunity for unauthorized wireless connections, so the outcome that both objectives exist to secure is already fully achieved in this environment.
4. D.Document a mixed determination: MET for the objective addressing identification of wireless access points, since a list of zero access points is complete and accurate, and NOT APPLICABLE for the objective addressing authorization, since there is nothing to authorize when no wireless access points are deployed.