Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 91:

  The CMMC Level 2 assessment methods include examination and can include:

  A. documents, mechanisms, or activities.
  B. specific hardware, software, or firmware safeguards employed within a system.
  C. policies, procedures, security plans, penetration tests, and security requirements.
  D. observation of system backup operations, exercising a contingency plan, and monitoring network traffic.
  D. observation of system backup operations, exercising a contingency plan, and monitoring network traffic.

• Question 92:

  In late September. CA.L2-3.12.1: Periodically assess the security controls in organizational systems to determine if the controls are effective in their application is assessed. Procedure specifies that a security control assessment shall be conducted quarterly. The Lead Assessor is only provided the first quarter assessment report because the person conducting the second quarter's assessment is currently out of the office and will return to the office in two hours. Based on this information, the Lead Assessor should determine that the evidence is;

  A. sufficient, and rate the audit finding as MET
  B. insufficient, and rate the audit finding as NOT MET.
  C. sufficient, and re-rate the audit finding after a quarter two assessment report is examined.
  D. insufficient, and re-rate the audit finding after a quarter two assessment report is examined.
  B. insufficient, and rate the audit finding as NOT MET.

• Question 93:

  An OSC lead has provided company information, identified that they are seeking CMMC Level 2, stated that they handle FCI. identified stakeholders, and provided assessment logistics. The OSC has provided the company's cyber hygiene practices that are posted on every workstation, visitor logs, and screenshots of the configuration of their FedRAMP-approved applications. The OSC has not won any DoD government contracts yet but is working on two proposals Based on this information, which statement BEST describes the CMMC Level 2 Assessment requirements?

  A. Ready because there is no need to certify this company until after they win a DoD contract.
  B. Not ready because the OSC is not on contract because they do not know the scope of FCI protection required by the contract.
  C. Not ready because the OSC still lacks artifacts that prove they have implemented all the CMMC Level 2 Assessment requirements.
  D. Ready because all DoD contractors are required to achieve CMMC Level 2; therefore, they are being proactive in seeking certification.
  C. Not ready because the OSC still lacks artifacts that prove they have implemented all the CMMC Level 2 Assessment requirements.

• Question 94:

  A CCP is assigned to verify evidence for PE.L1-3.10.1: Limit physical access to systems. Which evidence BEST supports this practice?

  A. Visitor logs for restricted rooms
  B. Antivirus signature update logs
  C. Employee onboarding forms
  D. Password rotation policy
  A. Visitor logs for restricted rooms

• Question 95:

  What is the MINIMUM required marking for a document containing CUI?

  A. "CUI" must be placed in the header and footer of the document
  B. "WCUI" must be placed in the header and footer of the document
  C. Portion marks must be placed on all sections, parts, paragraphs, etc. known to contain CUI
  D. A cover page must be placed to obscure content with the acronym "CUI" prominently placed
  A. "CUI" must be placed in the header and footer of the document

• Question 96:

  Which standard of assessment do all C3PAO organizations execute an assessment methodology based on?

  A. ISO 27001
  B. NISTSP800-53A
  C. CMMC Assessment Process
  D. Government Accountability Office Yellow Book
  C. CMMC Assessment Process

• Question 97:

  A Lead Assessor and an OSC's Assessment Official have agreed to have the Assessment results presented during the final Daily Checkpoint of the OSC's CMMC Level 2 Assessment. Which document MUST the Lead Assessor use to present assessment findings to the OSC?

  A. CMMC POAandM Brief
  B. CMMC Findings Brief
  C. CMMC Assessment Tracker Tool
  D. CMMC Recommended Findings template
  B. CMMC Findings Brief

• Question 98:

  An assessor observes that an OSC's firewall has multiple ANY-ANY rules. The firewall administrator claims they compensate with strong endpoint protection. What is the BEST assessment action?

  A. Accept the risk as mitigated by endpoint controls
  B. Score the practice MET because compensating controls exist
  C. Interview staff to understand the rules' purpose
  D. Determine the practice NOT MET due to overly permissive rules
  D. Determine the practice NOT MET due to overly permissive rules

• Question 99:

  SC.L2-3 13.14: Control and monitor the use of VoIP technologies is marked as NOT APPLICABLE for an OSC's assessment. How does this affect the assessment scope?

  A. Any existing telephone system is in scope even if it is not using VoIP technology.
  B. An error has been made and the Lead Assessor should be contacted to correct the error.
  C. VoIP technology is within scope, and it uses FlPS-validated encryption, so it does not need to be assessed.
  D. VoIP technology is not used within scope boundary, so no assessment procedures are specified for this practice.
  D. VoIP technology is not used within scope boundary, so no assessment procedures are specified for this practice.

• Question 100:

  A CCP is determining the assessment method for a practice requiring demonstration of system configuration. Which method is MOST appropriate?

  A. Interview
  B. Test
  C. Examine
  D. Affirmation
  B. Test