Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 231:

  Which domain includes the requirement to monitor system events and detect potential malicious activity?

  A. IR
  B. SI
  C. AC
  D. AU
  B. SI

• Question 232:

  An Assessment Team is conducting interviews with team members about their roles and responsibilities. The team member responsible for maintaining the antivirus program knows that it was deployed but has very little knowledge on how it works. Is this adequate for the practice?

  A. Yes, the antivirus program is available, so it is sufficient.
  B. Yes, antivirus programs are automated to run independently.
  C. No, the team member must know how the antivirus program is deployed and maintained.
  D. No, the team member's interview answers about deployment and maintenance are insufficient.
  C. No, the team member must know how the antivirus program is deployed and maintained.

• Question 233:

  The Lead Assessor is presenting the Final Findings Presentation to the OSC. During the presentation, the Assessment Sponsor and OSC staff inform the assessor that they do not agree with the assessment results. Who has the final authority for the assessment results?

  A. C3PAO
  B. CMMC-AB
  C. Assessment Team
  D. Assessment Sponsor
  A. C3PAO

• Question 234:

  Ethics is a shared responsibility between:

  A. DoD and CMMC-AB.
  B. OSC and sponsors.
  C. CMMC-AB and members of the CMMC Ecosystem.
  D. members of the CMMC Ecosystem and Lead Assessors.
  C. CMMC-AB and members of the CMMC Ecosystem.

• Question 235:

  A C3PAO has completed a Limited Practice Deficiency Correction Evaluation following an assessment of an OSC. The Lead Assessor has recommended moving deficiencies to a POAandM. but the OSC will remain on an Interim Certification. What is the MINIMUM number of practices that must be scored as MET to initiate this course of action?

  A. 80 practices
  B. 88 practices
  C. 100 practices
  D. 110 practices
  C. 100 practices

• Question 236:

  An OSC provides a written policy for removable media control but has no evidence that staff follow the policy. What is the BEST method to verify implementation?

  A. Review policy version history
  B. Interview staff responsible for media handling
  C. Request updated policy signatures
  D. Review the organization's training calendar
  B. Interview staff responsible for media handling

• Question 237:

  CMMC scoping covers the CUI environment encompassing the systems, applications, and services that focus on where CUI is:

  A. received and transferred.
  B. stored, processed, and transmitted.
  C. entered, edited, manipulated, printed, and viewed.
  D. located on electronic media, on system component memory, and on paper.
  B. stored, processed, and transmitted.

• Question 238:

  During the planning phase of the Assessment Process. C3PAO staff are reviewing the various entities associated with an OSC that has requested a CMMC Level 2 Assessment. Which term describes the people, processes, and technology external to the HQ Organization that participate in the assessment but will not receive a CMMC Level unless an enterprise Assessment is conducted?

  A. Host Unit
  B. Organization
  C. Coordinating Unit
  D. Supporting Organization/Unit
  D. Supporting Organization/Unit

• Question 239:

  During the planning phase of a CMMC Level 2 Assessment, the Lead Assessor is considering what would constitute the right evidence for each practice. What is the Assessor attempting to verify?

  A. Adequacy
  B. Sufficiency
  C. Process mapping
  D. Assessment scope
  B. Sufficiency

• Question 240:

  Companies that knowingly defraud the government by not being in compliance with cybersecurity regulations are at risk of being held liable for:

  A. The contract value plus a penalty as stated in the Cyber Claims Act
  B. The contract value plus a penalty as stated in the False Claims Act
  C. Three times the contract value plus a penalty as stated in the Cyber Claims Act
  D. Three times the contract value plus a penalty as stated in the False Claims Act
  D. Three times the contract value plus a penalty as stated in the False Claims Act