Cyber AB CMMC-CCP Real Exam Questions Test Engine Dumps Training With 172 Questions [Q81-Q102]

Q81. A C3PAO has completed a Limited Practice Deficiency Correction Evaluation following an assessment of an OSC. The Lead Assessor has recommended moving deficiencies to a POA&M. but the OSC will remain on an Interim Certification. What is the MINIMUM number of practices that must be scored as MET to initiate this course of action?

80 practices

88 practices

100 practices

110 practices

Q82. Exercising due care to ensure the information gathered during the assessment is protected even after the engagement has ended meets which code of conduct requirement?

Availability

Confidentiality

Information Integrity

Respect for Intellectual Property

Q83. During a Level 2 Assessment, the OSC has provided an inventory list of all hardware. The list includes servers, workstations, and network devices. Why should this evidence be sufficient for making a scoring determination for AC.L2-3.1.19: Encrypt CUI on mobile devices and mobile computing platforms?

The inventory list does not specify mobile devices.

The interviewee attested to encrypting all data at rest.

The inventory list does not include Bring Your Own Devices.

The DoD has accepted an alternative safeguarding measure for mobile devices.

Q84. Which term describes the process of granting or denying specific requests to obtain and use information, related information processing services, and enter specific physical facilities?

Access control

Physical access control

Mandatory access control

Discretionary access control

Q85. When assessing SI.L2-3.14.6: Monitor communications for attack, the CCA interviews the person responsible for the intrusion detection system and examines relevant policies and procedures for monitoring organizational systems. What would be a possible next step the CCA could conduct to gather sufficient evidence?

Conduct a penetration test

Interview the intrusion detection system’s supplier.

Upload known malicious code and observe the system response.

Review an artifact to check key references for the configuration of the IDS or IPS practice for additional guidance on intrusion detection and prevention systems.

Q86. While developing an assessment plan for an OSC. it is discovered that the certified assessor will be interviewing a former college roommate. What is the MOST correct action to take?

Do not inform the OSC and the C3PAO of the possible conflict of interest, and continue as planned.

Inform the OSC and the C3PAO of the possible conflict of interest, and start the entire process over without the conflicted team member.

Inform the OSC and the C3PAO of the possible conflict of interest but since it has been an acceptable amount of time since college, no conflict of interest exists, and continue as planned.

Inform the OSC and the C3PAO of the possible conflict of interest, document the conflict and mitigation actions in the assessment plan, and if the mitigation actions are acceptable, continue with the assessment.

Q87. During a Level 1 Self-Assessment, a smart thermostat was identified. It is connected to the Internet on the OSC’s WiFi network. What type of asset is this?

FCI Asset

CUI Asset

In-scope Asset

Specialized Asset

Q88. Which assessment method compares actual-specified conditions with expected behavior?

Test

Examine

Compile

Interview

Q89. While conducting a CMMC Assessment, a Lead Assessor is given documentation attesting to Level 1 identification and authentication practices by the OSC. The Lead Assessor asks the CCP to review the documentation to determine if identification and authentication controls are met. Which documentation BEST satisfies the requirements of IA.L1-3.5.1: Identify system users. processes acting on behalf of users, and devices?

Procedures for implementing access control lists

List of unauthorized users that identifies their identities and roles

User names associated with system accounts assigned to those individuals

Physical access policy that states. “All non-employees must wear a special visitor pass or be escorted.”

Q90. An assessment procedure consists of an assessment objective, potential assessment methods, and assessment objects. Which statement is part of an assessment objective?

Specifications and mechanisms

Examination, interviews, and testing

Determination statement related to the practice

Exercising assessment objects under specified conditions

Q91. A machining company has been awarded a contract with the DoD to build specialized parts. Testing of the parts will be done by the company using in-house staff and equipment. For a Level 1 Self-Assessment, what type of asset is this?

CUI Asset

In-scope Asset

Specialized Asset

Contractor Risk Managed Asset

Q92. The facilities manager for a company has procured a Wi-Fi enabled, mobile application-controlled thermostat for the server room, citing concerns over the inability to remotely gauge and control the temperature of the room. Because the thermostat is connected to the company’s FCI network, should it be assessed as partof the CMMC Level 1 Self-Assessment Scope?

No, because it is OT

No, because it is an loT device

Yes. because it is a restricted IS

Yes, because it is government property

Q93. A company has a government services division and a commercial services division. The government services division interacts exclusively with federal clients and regularly receives FCI. The commercial services division interacts exclusively with non-federal clients and processes only publicly available information. For this company’s CMMC Level 1 Self-Assessment, how should the assets supporting the commercial services division be categorized?

FCI Assets

Specialized Assets

Out-of-Scope Assets

Operational Technology Assets

Q94. An assessment is being completed at a client site that is not far from the Lead Assessor’s home office. The client provides a laptop for the duration of the engagement. During a meeting with the network engineers, the Lead Assessor requests information about the network. They respond that they have a significant number of drawings they can provide via their secure cloud storage service. The Lead Assessor returns to their home office and decides to review the documents. What is the BEST way to retrieve the documents?

Log into the secure cloud storage service to save copies of the documents on both the work and client laptops.

Log into the client VPN from the client laptop and retrieve the documents from the secure cloud storage service.

Log into the client VPN from the assessor’s laptop and retrieve the documents from the secure cloud storage service.

Use their home office workstation to retrieve the documents from the secure cloud storage service and save them to a USB stick.

Q95. Which entity requires that organizations handling FCI or CUI be assessed to determine a required Level of cybersecurity maturity?

DoD

CISA

NIST

CMMC-AB

Q96. Which resource contains authoritative data classifications of CUI?

NARA

CMMC-AB

DoD Contractors FAQ

OSC’s privacy policies

Q97. Which example represents a Specialized Asset?

SOCs

Hosted VPN services

Consultants who provide cybersecurity services

All property owned or leased by the government

Q98. After completing a Level 2 Assessment, a C3PAO is preparing to upload the Assessment Results Package to Enterprise Mission Assurance Support Service. Which document MUST be included as part of the final assessment results package?

Final Report

Certification rating

Summary-level findings

All Daily Checkpoint logs

Q99. A company is about to conduct a press release. According to AC.L1-3.1.22: Control information posted or processed on publicly accessible systems, what is the MOST important factor to consider when addressing CMMC requirements?

That the information is correct

That the CEO approved the message

That the company has to safeguard the release of FCI

That so long as the information is only FCI, it can be released

Q100. While determining the scope for a company’s CMMC Level 1 Self-Assessment, the contract administrator includes the hosting providers that manage their IT infrastructure. Which asset type BEST describes the third- party organization?

ESPs

People

Facilities

Technology

Q101. An assessor has been working with an OSC’s point of contact to plan and prepare for their upcoming assessment. What is one of the MOST important things to remember when analyzing requirements for an assessment?

Scoping an assessment is easy and worry-free.

The initial plan cannot be changed once agreed upon.

There is a determined amount of time that the OSC’s point of contact has to submit evidence and rough order-of-magnitude.

Assessors need to continuously review and update the requirements and plan for the assessment as information is gathered.

Q102. Who makes the final determination of the assessment method used for each practice?

CCP

osc

Site Manager

Lead Assessor