Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 171:

  While conducting a CMMC Assessment, an individual from the OSC provides documentation to the assessor for review. The documentation states an incident response capability is established and contains information on incident preparation, detection, analysis, containment, recovery, and user response activities. Which CMMC practice is this documentation attesting to?

  A. IR.L2-3.6.1: Incident Handling
  B. IR.L2-3.6.2: Incident Reporting
  C. IR.L2-3.6.3: Incident Response Testing
  D. IR.L2-3.6.4: Incident Spillage
  A. IR.L2-3.6.1: Incident Handling

• Question 172:

  A test or demonstration is being performed for the Assessment Team during an assessment. Which environment MUST the OSC perform this test or demonstration?

  A. Client
  B. Production
  C. Development
  D. Demonstration
  B. Production

• Question 173:

  Per DoDI 5200.48: Controlled Unclassified Information (CUI), CUI is marked by whom?

  A. DoD OUSD
  B. Authorized holder
  C. Information Disclosure Official
  D. Presidential authorized Original Classification Authority
  B. Authorized holder

• Question 174:

  What is objectivity as it applies to activities with the CMMC-AB?

  A. Ensuring full disclosure
  B. Reporting results of CMMC services completely
  C. Avoiding the appearance of or actual, conflicts of interest
  D. Demonstrating integrity in the use of materials as described in policy
  C. Avoiding the appearance of or actual, conflicts of interest

• Question 175:

  During an interview, the OSC system administrator states they "think logs are retained for a few weeks" but cannot provide the exact retention setting. What should the assessor do NEXT?

  A. Accept the verbal explanation as affirmation
  B. Request artifacts demonstrating log retention
  C. Mark the practice as NOT MET
  D. Request the administrator's training history
  B. Request artifacts demonstrating log retention

• Question 176:

  A contractor has implemented IA.L2-3.5.3: Multifactor Authentication practice for their privileged users, however, during the assessment it was discovered that the OSC's standard users do not require MFA to access their endpoints and network resources. What would be the BEST finding?

  A. The process is running correctly.
  B. It is out of scope as this is a new acquisition.
  C. The new acquisition is considered Specialized Assets.
  D. Practice is NOT MET since the objective was not implemented.
  D. Practice is NOT MET since the objective was not implemented.

• Question 177:

  An assessor has been working with an OSC's point of contact to plan and prepare for their upcoming assessment. What is one of the MOST important things to remember when analyzing requirements for an assessment?

  A. Scoping an assessment is easy and worry-free.
  B. The initial plan cannot be changed once agreed upon.
  C. There is a determined amount of time that the OSC's point of contact has to submit evidence and rough order-of-magnitude.
  D. Assessors need to continuously review and update the requirements and plan for the assessment as information is gathered.
  D. Assessors need to continuously review and update the requirements and plan for the assessment as information is gathered.

• Question 178:

  What is the BEST document to find the objectives of the assessment of each practice?

  A. CMMC Glossary
  B. CMMC Appendices
  C. CMMC Assessment Process
  D. CMMC Assessment Guide Levels 1 and 2
  D. CMMC Assessment Guide Levels 1 and 2

• Question 179:

  A server is used to store FCI with a cloud provider long-term. What is the server considered?

  A. In scope, because the cloud provider will be storing the FCI data
  B. Out of scope, because the cloud provider stores the FCI data long-term
  C. In scope, because the cloud provider is required to be CMMC Level 2 certified
  D. Out of scope, because encryption is always used when the cloud provider stores the FCI data
  A. In scope, because the cloud provider will be storing the FCI data

• Question 180:

  The Advanced Level in CMMC will contain Access Control (AC) practices from:

  A. Level 1
  B. Level 3
  C. Levels 1 and 2
  D. Levels 1, 2, and 3
  D. Levels 1, 2, and 3