Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 191:

  An assessor is in Phase 3 of the CMMC Assessment Process. The assessor has delivered the final findings, submitted the assessment results package, and provided feedback to the C3PAO and CMMC-AB. What must the assessor still do?

  A. Determine level recommendation
  B. Archive all assessment artifacts
  C. Determine final practice pass/fail results
  D. Archive or dispose of any assessment artifacts
  D. Archive or dispose of any assessment artifacts

• Question 192:

  The Lead Assessor interviews a network security specialist of an OSC. The incident monitoring report for the month shows that no security incidents were reported from OSC's external SOC service provider. This is provided as evidence for RA.L2-3.11.2: Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. Based on this information, the Lead Assessor should conclude that the evidence is:

  A. inadequate because it is irrelevant to the practice.
  B. adequate because it fits well for expected artifacts.
  C. adequate because no security incidents were reported.
  D. inadequate because the OSC's service provider should be interviewed.
  A. inadequate because it is irrelevant to the practice.

• Question 193:

  Which statement BEST describes why sufficiency is required when evaluating evidence?

  A. It determines whether the practice intent is communicated
  B. It ensures enough evidence is present to support a MET determination
  C. It verifies the organization's SSP is complete
  D. It confirms that procedures exist for all domains
  B. It ensures enough evidence is present to support a MET determination

• Question 194:

  In performing scoping, what should the assessor ensure that the scope of the assessment covers?

  A. All assets documented in the business plan
  B. All assets regardless if they do or do not process, store, or transmit FCI/CUI
  C. All entities, regardless of the line of business, associated with the organization
  D. All assets processing, storing, or transmitting FCI/CUI and security protection assets
  D. All assets processing, storing, or transmitting FCI/CUI and security protection assets

• Question 195:

  The practices in CMMC Level 2 consists of the security requirements specified in:

  A. NISTSP 800-53.
  B. NISTSP 800-171.
  C. 48 CFR 52.204-21.
  D. DFARS 252.204-7012.
  B. NISTSP 800-171.

• Question 196:

  A defense contractor needs to share FCI with a subcontractor and sends this data in an email. The email system involved in this process is being used to:

  A. manage FCI.
  B. process FCI.
  C. transmit FCI.
  D. generate FCI
  C. transmit FCI.

• Question 197:

  Regarding the Risk Assessment (RA) domain, what should an OSC periodically assess?

  A. Organizational operations, business assets, and employees
  B. Organizational operations, business processes, and employees
  C. Organizational operations, organizational assets, and individuals
  D. Organizational operations, organizational processes, and individuals
  C. Organizational operations, organizational assets, and individuals

• Question 198:

  Which code or clause requires that a contractor is meeting the basic safeguarding requirements for FCI during a Level 1 Self-Assessment?

  A. FAR 52.204-21
  B. 22CFR 120-130
  C. DFARS 252.204-7011
  D. DFARS 252.204-7021
  A. FAR 52.204-21

• Question 199:

  Which scenario BEST demonstrates a conflict of interest?

  A. An assessor previously consulted for the OSC on CMMC readiness
  B. An assessor used to work in the same industry
  C. An assessor graduated from the same university as an OSC employee
  D. An assessor knows an OSC employee socially
  A. An assessor previously consulted for the OSC on CMMC readiness

• Question 200:

  According to the Configuration Management (CM) domain, which principle is the basis for defining essential system capabilities?

  A. Least privilege
  B. Essential concern
  C. Least functionality
  D. Separation of duties
  C. Least functionality