Cyber AB CMMC-CCP Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCP Online Questions & Answers

• Question 61:

  Where does the requirement to include a required practice of ensuring that personnel are trained to carry out their assigned information security-related duties and responsibilities FIRST appear?

  A. Level 1
  B. Level 2
  C. Level 3
  D. All levels
  B. Level 2

• Question 62:

  How are the Final Recommended Assessment Findings BEST presented?

  A. Using the CMMC Findings Brief template
  B. Using a C3PAO-provided template that is preferred by the OSC
  C. Using a C3PAO-branded version of the CMMC Findings Brief template
  D. Using the proprietary template created by the Lead Assessor after approval from the C3PAO
  A. Using the CMMC Findings Brief template

• Question 63:

  What is the BEST description of the purpose of FAR clause 52 204-21?

  A. It directs all covered contractors to install the cyber security systems listed in that clause.
  B. It describes all of the safeguards that contractors must take to secure covered contractor IS.
  C. It describes the minimum standard of care that contractors must take to secure covered contractor IS.
  D. It directs covered contractors to obtain CMMC Certification at the level equal to the lowest requirement of their contracts.
  C. It describes the minimum standard of care that contractors must take to secure covered contractor IS.

• Question 64:

  When a conflict of interest is unavoidable, a CCP should NOT:

  A. Inform their organization
  B. Take action to minimize its impact
  C. Disclose it to affected stakeholders
  D. Conceal it from the Assessment Team lead
  D. Conceal it from the Assessment Team lead

• Question 65:

  An OSC receives an email with "CUI//SP-PRVCY//FED Only" in the body of the message Which organization's website should the OSC go to identify what this marking means?

  A. NARA
  B. CMMC-AB
  C. DoD Contractors FAQ page
  D. DoD 239.7601 Definitions page
  A. NARA

• Question 66:

  A company is about to conduct a press release. According to AC.L1-3.1.22: Control information posted or processed on publicly accessible systems, what is the MOST important factor to consider when addressing CMMC requirements?

  A. That the information is correct
  B. That the CEO approved the message
  C. That the company has to safeguard the release of FCI
  D. That so long as the information is only FCI, it can be released
  C. That the company has to safeguard the release of FCI

• Question 67:

  Prior to conducting a CMMC Assessment, the contractor must specify the CMMC Assessment scope by categorizing all assets. Which two asset categories are always assessed against CMMC practices?

  A. CUI Assets and Specialized Assets
  B. Security Protection Assets and CUI Assets
  C. Specialized Assets and Contractor Risk Managed Assets
  D. Security Protection Assets and Contractor Risk Managed Assets
  B. Security Protection Assets and CUI Assets

• Question 68:

  A CCP is working as an Assessment Team Member on a CMMC Level 2 Assessment. The Lead Assessor has assigned the CCP to assess the OSC's Configuration Management (CM) domain. The CCP's first interview is with a subject-matter expert for user-installed software. With respect to user-installed software, what facet should the CCP's interview focus on?

  A. Controlled and monitored
  B. Removed from the system
  C. Scanned for malicious code
  D. Limited to mission-essential use only
  A. Controlled and monitored

• Question 69:

  A CCP is reviewing the OSC's Access Control domain. The OSC uses shared accounts for administrative access but claims MFA compensates for the risk. How should the CCP respond?

  A. Shared accounts are acceptable with MFA
  B. Shared accounts are acceptable when monitored
  C. Shared accounts violate the practice intent
  D. Shared accounts are acceptable if documented
  C. Shared accounts violate the practice intent

• Question 70:

  An OSC performing a CMMC Level 1 Self-Assessment uses a legacy Windows 95 computer, which is the only system that can run software that the government contract requires. Why can this asset be considered out of scope?

  A. It handles CUI
  B. It is a restricted IS
  C. It is government property
  D. It is operational technology
  B. It is a restricted IS