Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 1:

  The Audit and Accountability (AU) domain has practices in:

  A. Level 1.
  B. Level 2.
  C. Levels 1 and 2.
  D. Levels 1 and 3.
  B. Level 2.

• Question 2:

  A CMMC Level 1 Self-Assessment identified an asset in the OSC's facility that does not process, store, or transmit FCI. Which type of asset is this considered?

  A. FCI Assets
  B. Specialized Assets
  C. Out-of-Scope Assets
  D. Government-Issued Assets
  C. Out-of-Scope Assets

• Question 3:

  Which method facilitates understanding by analyzing gathered artifacts as evidence?

  A. Test
  B. Examine
  C. Behavior
  D. Interview
  B. Examine

• Question 4:

  Within how many days from the Assessment Final Recommended Findings Brief should the Lead Assessor and Assessment Team Members, if necessary, review the accuracy and validity of (he OSC's updated POAandM with any accompanying evidence or scheduled collections?

  A. 90 days
  B. 180 days
  C. 270 days
  D. 360 days
  B. 180 days

• Question 5:

  When scoping the organizational system, the scope of applicability for the cybersecurity CUI practices applies to the components of:

  A. federal systems that process, store, or transmit CUI.
  B. nonfederal systems that process, store, or transmit CUI.
  C. federal systems that process, store, or transmit CUI. or that provide protection for the system components.
  D. nonfederal systems that process, store, or transmit CUI. or that provide protection for the system components.
  D. nonfederal systems that process, store, or transmit CUI. or that provide protection for the system components.

• Question 6:

  The evidence needed for each practice and/or process is weighed for:

  A. Adequacy and sufficiency
  B. Adequacy and thoroughness
  C. Sufficiency and thoroughness
  D. Sufficiency and appropriateness
  A. Adequacy and sufficiency

• Question 7:

  There are 15 practices that are NOT MET for an OSC's Level 2 Assessment. All practices are applicable to the OSC. Which determination should be reached?

  A. The OSC may have 90 days for remediating NOT MET practices.
  B. The OSC is not eligible for an option to remediate NOT MET practices.
  C. The OSC may be eligible for an option to remediate NOT MET practices.
  D. The OSC is not eligible for an option to remediate after the assessment is canceled.
  C. The OSC may be eligible for an option to remediate NOT MET practices.

• Question 8:

  During a Level 2 assessment, the OSC asserts that their contractor risk-managed assets do not need to be documented in the asset inventory. Which statement is correct?

  A. They must be documented because they may store CUI
  B. They must be documented per scoping requirements
  C. They are not required in the inventory because they are out of scope
  D. They are documented only if owned by the government
  B. They must be documented per scoping requirements

• Question 9:

  Which authority leads the CMMC direction, standards, best practices, and knowledge framework for how to map the controls and processes across different Levels that range from basic cyber hygiene to advanced cyber practices?

  A. NIST
  B. DoD CIO office
  C. Federal CIO office
  D. Defense Federal Acquisition Regulation Council
  B. DoD CIO office

• Question 10:

  Where can a listing of all federal agencies' CUI indices and categories be found?

  A. 32 CFR Section 2002
  B. Official CUI Registry
  C. Executive Order 13556
  D. Official CMMC Registry
  B. Official CUI Registry