CMMC CMMC-CCP Dumps PDF

Page: 11 / 12

Question 44

What is the BEST description of the purpose of FAR clause 52 204-21?

Options:

It directs all covered contractors to install the cyber security systems listed in that clause.

It describes all of the safeguards that contractors must take to secure covered contractor IS.

It describes the minimum standard of care that contractors must take to secure covered contractor IS.

It directs covered contractors to obtain CMMC Certification at the level equal to the lowest requirement of their contracts.

Question 45

An assessment procedure consists of an assessment objective, potential assessment methods, and assessment objects. Which statement is part of an assessment objective?

Options:

Specifications and mechanisms

Examination, interviews, and testing

Determination statement related to the practice

Exercising assessment objects under specified conditions

Question 46

Which domain has a practice requiring an organization to restrict, disable, or prevent the use of nonessential programs?

Options:

Access Control (AC)

Media Protection (MP)

Asset Management (AM)

Configuration Management (CM)

Question 47

A Lead Assessor has been assigned to a CMMC Assessment During the assessment, one of the assessors approaches with a signed policy. There is one signatory, and that person has since left the company. Subsequently, another person was hired into that position but has not signed the document. Is this document valid?

Options:

The signatory is the authority to implement and enforce the policy, and since that person is no longer with the company, the policy is not valid.

More research on the company policy of creating, implementing, and enforcing policies is needed. If the company has a policy identifying the authority as with the position or person, then the policy is valid.

The signatory does not validate or invalidate the policy. For the purpose of this assessment, ensuring that the policy is current and is being implemented by the individuals who are performing the work is sufficient.

The authority to implement and enforce lies with the position, not the person. As long as that position's authority and responsibilities have not been removed from implementing that domain, it is still a valid policy.

Page: 11 / 12