Exam CMMC-CCA Topic 1 Question 54 Discussion
Actual exam question for Cyber AB's CMMC-CCA exam
Question #: 54
Topic #: 1
Question #: 54
Topic #: 1
As a CCA on a C3PAO Assessment Team, you have determined that the assessment scope provided by an OSC indicates plans to subcontract some elements of their contract to DelTech Inc. The OSC plans to bid on a DoD contract to develop guidance and targeting software. However, the software needs testing after installing a new surface-to-air defense system. Unfortunately, the OSC lacks themeans to test the software, which is where DelTech comes in. As a CCA, what must you do in this scenario?
Suggested Answer: D Vote an answer
Comprehensive and Detailed in Depth Explanation:
DFARS 252.204-7012 requires subcontractors handling CUI (like DelTech testing software with CUI) to meet CMMC requirements via flowdown clauses. The CCA must confirm these clauses exist and that DelTech's certification matches the risk level (likely Level 2 for CUI), per CAP. Option A is incorrect- subcontracting is allowed with compliance. Option B exceeds the CCA's scope. Option C ignores subcontractor requirements. Option D is the correct answer.
Reference Extract:
* DFARS 252.204-7012(b)(2):"Flow down CMMC requirements to subcontractors handling CUI."
* CMMC Assessment Process (CAP) v1.0, Section 3.2:"Verify subcontractor certification aligns with information risk."Resources:https://www.acquisition.gov/dfars/252.204-7012;https://cyberab.org
/Portals/0/Documents/Process-Documents/CMMC-Assessment-Process-CAP-v1.0.pdf
DFARS 252.204-7012 requires subcontractors handling CUI (like DelTech testing software with CUI) to meet CMMC requirements via flowdown clauses. The CCA must confirm these clauses exist and that DelTech's certification matches the risk level (likely Level 2 for CUI), per CAP. Option A is incorrect- subcontracting is allowed with compliance. Option B exceeds the CCA's scope. Option C ignores subcontractor requirements. Option D is the correct answer.
Reference Extract:
* DFARS 252.204-7012(b)(2):"Flow down CMMC requirements to subcontractors handling CUI."
* CMMC Assessment Process (CAP) v1.0, Section 3.2:"Verify subcontractor certification aligns with information risk."Resources:https://www.acquisition.gov/dfars/252.204-7012;https://cyberab.org
/Portals/0/Documents/Process-Documents/CMMC-Assessment-Process-CAP-v1.0.pdf
by Hiram at Nov 17, 2025, 01:23 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).