Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 31:

  Which resource contains authoritative data classifications of CUI?

  A. NARA
  B. CMMC-AB
  C. DoD Contractors FAQ
  D. OSC's privacy policies
  A. NARA

• Question 32:

  While conducting a CMMC Level 2 Assessment, the Lead Assessor determines that the OSC has badge readers, pin code pads, and keys for various access points as well as documentation to demonstrate meeting the practice. Which CMMC practice has the OSC MET?

  A. PE.L1-3.10.5: Control and manage physical access devices
  B. MP.L2-3.8.5: Mark media with necessary CUI markings and distribution limitations
  C. SI.L2-3.14.3: Monitor system security alerts and advisories and take action in response
  D. PS.L2-3.9.2: Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers
  A. PE.L1-3.10.5: Control and manage physical access devices

• Question 33:

  Which NIST SP defines the Assessment Procedure leveraged by the CMMC?

  A. NIST SP 800-53
  B. NISTSP800-53a
  C. NIST SP 800-171
  D. NISTSP800-171a
  D. NISTSP800-171a

• Question 34:

  After completing a Level 2 Assessment, a C3PAO is preparing to upload the Assessment Results Package to Enterprise Mission Assurance Support Service. Which document MUST be included as part of the final assessment results package?

  A. Final Report
  B. Certification rating
  C. Summary-level findings
  D. All Daily Checkpoint logs
  A. Final Report

• Question 35:

  In scoping a CMMC Level 1 Self-Assessment, all of the computers and digital assets that handle FCI are identified. A file cabinet that contains paper FCI is also identified. What can this file cabinet BEST be determined to be?

  A. In scope, because it is an asset that stores FCI
  B. In scope, because it is part of the same physical location
  C. Out of scope, because they are all only paper documents
  D. Out of scope, because it does not process or transmit FCI
  D. Out of scope, because it does not process or transmit FCI

• Question 36:

  Validation of findings is an iterative process usually performed during the Daily Checkpoints throughout the entire assessment process. As a validation activity, why are the preliminary findings important?

  A. It allows the OSC to comment and provide additional evidence.
  B. It determines whether the OSC will be rated MET or NOT MET on their assessment.
  C. It confirms that the Assessment Team's findings are right and cannot be changed.
  D. It corroborates the Assessment Team's understanding of the CMMC practices and controls.
  A. It allows the OSC to comment and provide additional evidence.

• Question 37:

  Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1. Guidelines for Media Sanitation?

  A. Clear, purge, destroy
  B. Clear redact, destroy
  C. Clear, overwrite, purge
  D. Clear, overwrite, destroy
  A. Clear, purge, destroy

• Question 38:

  What is the MOST common purpose of assessment procedures?

  A. Obtain evidence.
  B. Define level of effort.
  C. Determine information flow.
  D. Determine value of hardware and software.
  A. Obtain evidence.

• Question 39:

  When an OSC requests an assessment by a C3PAO, who selects the Lead Assessor for the assessment?

  A. OSC
  B. C3PAO
  C. C3PAO and OSC D. OSC and Lead Assessor
  B. C3PAO

• Question 40:

  A Lead Assessor has been assigned to a CMMC Assessment During the assessment, one of the assessors approaches with a signed policy. There is one signatory, and that person has since left the company. Subsequently, another person was hired into that position but has not signed the document. Is this document valid?

  A. The signatory is the authority to implement and enforce the policy, and since that person is no longer with the company, the policy is not valid.
  B. More research on the company policy of creating, implementing, and enforcing policies is needed. If the company has a policy identifying the authority as with the position or person, then the policy is valid.
  C. The signatory does not validate or invalidate the policy. For the purpose of this assessment, ensuring that the policy is current and is being implemented by the individuals who are performing the work is sufficient.
  D. The authority to implement and enforce lies with the position, not the person. As long as that position's authority and responsibilities have not been removed from implementing that domain, it is still a valid policy.
  C. The signatory does not validate or invalidate the policy. For the purpose of this assessment, ensuring that the policy is current and is being implemented by the individuals who are performing the work is sufficient.