Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 141:

  The Advanced Level in CMMC will contain Access Control {AC) practices from:

  A. Level 1.
  B. Level 3.
  C. Levels 1 and 2.
  D. Levels 1,2, and 3.
  D. Levels 1,2, and 3.

• Question 142:

  In many organizations, the protection of FCI includes devices that are used to scan physical documentation into digital form and print physical copies of digital FCI. What technical control can be used to limit multi-function device (MFD) access to only the systems authorized to access the MFD?

  A. Virtual LAN restrictions
  B. Single administrative account
  C. Documentation showing MFD configuration
  D. Access lists only known to the IT administrator
  A. Virtual LAN restrictions

• Question 143:

  A contractor stores security policies, system configuration files, and audit logs in a centralized file repository for later review. According to CMMC terminology, the file repository is being used to:

  A. protect CUI.
  B. transmit CUI.
  C. store CUI.
  D. generate CUI
  C. store CUI.

• Question 144:

  An Assessment Team is conducting a Level 2 Assessment at the request of an OSC. The team has begun to score practices based on the evidence provided. At a MINIMUM what is required of the Assessment Team to determine if a practice is scored as MET?

  A. All three types of evidence are documented for every control.
  B. Examine and accept evidence from one of the three evidence types.
  C. Complete one of the following; examine two artifacts, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.
  D. Complete two of the following: examine one artifact, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.
  D. Complete two of the following: examine one artifact, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.

• Question 145:

  A C3PAO is near completion of a Level 2 Assessment for an OSC. The CMMC Findings Brief and CMMC Assessment Results documents have been developed. The Final Recommended Assessment Results are being generated. When generating these results, what MUST be included?

  A. An updated Assessment Plan
  B. Recorded and final updated Daily Checkpoint
  C. Fully executed CMMC Assessment contract between the C3PAO and the OSC
  D. Review documentation for the CMMC Quality Assurance Professional (CQAP)
  D. Review documentation for the CMMC Quality Assurance Professional (CQAP)

• Question 146:

  The IT manager is scoping the company's CMMC Level 1 Self-Assessment. The manager considers which servers, laptops. databases, and applications are used to store, process, or transmit FCI. Which asset type is being considered by the IT manager?

  A. ESP
  B. People
  C. Facilities
  D. Technology
  D. Technology

• Question 147:

  A Lead Assessor is reviewing evidence for a practice requiring periodic vulnerability scanning. The OSC provides a single scan artifact from eight months ago. The policy states scans must occur monthly. What determination should the Lead Assessor make?

  A. Evidence is adequate due to the policy language
  B. Evidence is insufficient because scans did not follow the policy
  C. Evidence is sufficient because scanning tools were deployed
  D. Evidence is adequate since scans are not required monthly
  B. Evidence is insufficient because scans did not follow the policy

• Question 148:

  A FedRAMP-moderate cloud vendor stores CUI on behalf of an OSC. What requirement from DFARS 252.204-7012 applies to the vendor?

  A. Incident reporting in 96 hours
  B. Encryption using commercial-grade solutions
  C. Compliance with NARA marking rules
  D. Meeting FedRAMP Moderate baseline security controls
  D. Meeting FedRAMP Moderate baseline security controls

• Question 149:

  The OSC claims a practice is MET because they have a policy. Evidence shows the procedure is not being followed. Which principle applies?

  A. Policies outweigh procedures
  B. Implementation determines compliance
  C. Intent outweighs execution
  D. Documentation is always sufficient
  B. Implementation determines compliance

• Question 150:

  During a CMMC readiness review, the OSC proposes that an associated enclave should not be applicable in the scope. Who is responsible for verifying this request?

  A. CCP
  B. C3PAO
  C. Lead Assessor
  D. Advisory Board
  C. Lead Assessor