Comprehensive and Detailed Explanation:

The CMMC Level 2 framework requires that all assets within the assessment scope that process, store, or transmit CUI (CUI Assets) or provide security protections (SPAs) be assessed against the full set of 110 CMMC practices derived from NIST SP 800-171. The CMMC Assessment Scope - Level 2 explicitly states that both CUI Assets and SPAs are critical to the security posture and must undergo a comprehensive assessment to ensure compliance with Level 2 requirements. This full assessment ensures that no vulnerabilities are overlooked in assets directly handling or protecting CUI.

Option A is incorrect because a subset of controls does not meet the Level 2 requirement for full compliance. Option B (spot checks) is insufficient for a certification assessment, as it lacks the rigorneeded for Level 2. Option C limits the review to the SSP, which is only one part of the assessment process, not the full evaluation required. Option D aligns with the official guidance.