Câu 27: CCA: CMMC Certified Assessor

An OSC outsources all of its security incident and event monitoring work to a third-party SOC. Additionally, the OSC utilizes a cloud hosted antivirus (AV) system to fulfill the requirement of having virus protection without hosting additional servers on-site. During the scoping discussion, both the SOC and AV should be listed as what type of asset?

1. A. They are Out-of-Scope Assets due to being fully hosted/operated by third parties.
2. B. They are Security Protection Assets due to their performance of security functions. — đáp án hiện tại
3. C. They are CUI Assets due to their operation within a CUI network.
4. D. They are Contractor Risk Managed Assets because they are not physically or logically isolated from CUI assets.