Free CMMC-CCP Exam Dumps Preview

The Lead Assessor interviews a network security specialist of an OSC. The incident monitoring report for the month shows that no security incidents were reported from OSC's external SOC service provider. This is provided as evidence for RA.L2-3.11.2: Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. Based on this information, the Lead Assessor should conclude that the evidence is:

The facilities manager for a company has procured a Wi-Fi enabled, mobile application-controlled thermostat for the server room, citing concerns over the inability to remotely gauge and control the temperature of the room.
Because the thermostat is connected to the company's FCI network, should it be assessed as part of the CMMC Level 1 Self-Assessment Scope?

During Phase 4 of the Assessment process, what MUST the Lead Assessor determine and recommend to the C3PAO concerning the OSC?

The results package for a Level 2 Assessment is being submitted. What MUST a Final Report.
CMMC Assessment Results include?

In preparation for a CMMC Level 1 Self-Assessment, the IT manager for a DIB organization is documenting asset types in the company's SSP The manager determines that identified machine controllers and assembly machines should be documented as Specialized Assets.

Which type of Specialized Assets has the manager identified and documented?

Which phase of the CMMC Assessment Process includes developing the assessment plan?

A contractor has implemented IA.L2-3.5.3: Multifactor Authentication practice for their privileged users, however, during the assessment it was discovered that the OSC's standard users do not require MFA to access their endpoints and network resources.

What would be the BEST finding?

A CMMC Level 1 Self-Assessment identified an asset in the OSC's facility that does not process, store, or transmit FCI.

Which type of asset is this considered?

Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1.
Guidelines for Media Sanitation?

Which NIST SP defines the Assessment Procedure leveraged by the CMMC?

In CMMC High-Level scoping, which definition BEST describes an HQ organization?

Which term describes the process of granting or denying specific requests to obtain and use information, related information processing services, and enter specific physical facilities?

The practices in CMMC Level 2 consists of the security requirements specified in:

Which domain references the requirements needed to handle physical or digital assets containing CUI?

An OSC has requested a C3PAO to conduct a Level 2 Assessment. The C3PAO has agreed, and the two organizations have collaborated to develop the Assessment Plan.
Who agrees to and signs off on the Assessment Plan?

While conducting a CMMC Level 2 Assessment, a CCP is reviewing an OSC's personnel security process.
They have a policy that describes screening individuals prior to authorizing access to CUI, but it does not mention what organizations should be looking for in an individual. There is no link to a process or procedural document.

What should the OSC evaluate when screening individuals prior to accessing CUI?

What is the MOST common purpose of assessment procedures?

Contractor scoping requirements for a CMMC Level 2 Assessment to document the asset in an inventory, in the SSP and on the network diagram apply to:

Which situation MOST clearly represents a conflict of interest during an assessment?

A CCP is reviewing AC.L1-3.1.2: Limit information system access to the types of transactions and functions that authorized users are permitted to execute.

Which artifact BEST supports this practice?

Which of the following practices belongs to the System and Communications Protection (SC) domain?

Which scenario BEST demonstrates a conflict of interest?

When planning an assessment, the Lead Assessor should work with the OSC to select personnel to be interviewed who could:

Which code or clause requires that a contractor is meeting the basic safeguarding requirements for FCI during a Level 1 Self-Assessment?

During an assessment, which phase of the process identifies conflicts of interest?

While determining the scope for a company's CMMC Level 1 Self-Assessment, the contract administrator includes the hosting providers that manage their IT infrastructure.

Which asset type BEST describes the third-party organization?

What type of information is NOT intended for public release and is provided by or generated for the government under a contract to develop or deliver a product or service to the government, but not including information provided by the government to the public (such as on public websites) or simple transactional information, such as necessary to process payments?

Which domains are a part of a Level 1 Self-Assessment?

When executing a remediation review, the Lead Assessor should:

Which statement BEST describes the requirements for a C3PA0?

In the Code of Professional Conduct, what does the practice of Professionalism require?

An assessment is being completed at a client site that is not far from the Lead Assessor's home office. The client provides a laptop for the duration of the engagement. During a meeting with the network engineers, the Lead Assessor requests information about the network. They respond that they have a significant number of drawings they can provide via their secure cloud storage service. The Lead Assessor returns to their home office and decides to review the documents.

What is the BEST way to retrieve the documents?

Regarding the Risk Assessment (RA) domain, what should an OSC periodically assess?

Plan of Action defines the clear goal or objective for the plan.

What information is generally NOT a part of a plan of action?

A CCP is assessing CM.L2-3.4.3: Track, review, approve/disapprove, and audit changes to organizational systems.

Which evidence MOST directly supports this practice?

In the CMMC Model, how many practices are included in Level 1?

A Level 2 Assessment of an OSC is winding down and the final results are being prepared to present to the OSC.

When should the final results be delivered to the OSC?