Cyber AB CMMC-CCP Practice Exam Questions

Cyber AB CMMC-CCP Sample Question Answers

Question # 1

For the purpose of determining scope, what needs to be included as part of the assessment but would NOT receive a CMMC certification unless an enterprise assessment is conducted? 

A. ESP 
B. People 
C. Test equipment 
D. Government property 

Show Answer

Question # 2

Which document is used to protect sensitive and confidential information from being made available by the recipient of that information? 

A. Legal agreement 
B. CMMC agreement 
C. Assessment agreement 
D. Non-disclosure agreement 

Show Answer

Question # 3

A Lead Assessor is preparing to conduct a Readiness Review during Phase 1 of the Assessment Process. How much evidence MUST be gathered for each practice?

A. A sufficient amount 
B. At least 2 Assessment Objects
 C. Evidence that is deemed adequate 
D. Evidence to support at least 2 Assessment Methods 

Show Answer

Question # 4

In CMMC High-Level scoping, which definition BEST describes an HQ organization? 

A. The entity that carries out the tasks under a contract 
B. The unit to which a CMMC Level is applied for each contract 
C. The teams, services, and technologies that provide support to a Host Unit 
D. The entity legally responsible for the delivery of products or services under a contract 

Show Answer

Question # 5

While conducting a CMMC Level 2 Assessment, the Lead Assessor determines that the OSC has badge readers, pin code pads, and keys for various access points as well as documentation to demonstrate meeting the practice. Which CMMC practice has the OSC MET? 

A. PE.L1-3.10.5: Control and manage physical access devices 
B. MP.L2-3.8.5: Mark media with necessary CUI markings and distribution limitations 
C. SI.L2-3.14.3: Monitor system security alerts and advisories and take action in response 
D. PS.L2-3.9.2: Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers 

Show Answer

Question # 6

Which CMMC Levels focus on protecting CUI from exfiltration? 

A. Levels 1 and 2 
B. Levels 1 and 3 
C. Levels 2 and 3 
D. Levels 1, 2, and 3 

Show Answer

Question # 7

The facilities manager for a company has procured a Wi-Fi enabled, mobile applicationcontrolled thermostat for the server room, citing concerns over the inability to remotely gauge and control the temperature of the room. Because the thermostat is connected to the company's FCI network, should it be assessed as part of the CMMC Level 1 SelfAssessment Scope?

A. No, because it is OT 
B. No, because it is an loT device 
C. Yes. because it is a restricted IS 
D. Yes, because it is government property 

Show Answer

Question # 8

A server is used to store FCI with a cloud provider long-term. What is the server considered? 

A. In scope, because the cloud provider will be storing the FCI data 
B. Out of scope, because the cloud provider stores the FCI data long-term 
C. In scope, because the cloud provider is required to be CMMC Level 2 certified 
D. Out of scope, because encryption is always used when the cloud provider stores the FCI data 

Show Answer

Question # 9

For a CMMC Level 2 certification, which organization maintains a non-disclosure agreement with the OSC?

A. NIST 
B. C3PAO
 C. CMMC-AB
D. OUSD A&S 

Show Answer

Question # 10

What technical means can an OSC have in place to limit individuals who are authorized to post or process information on publicly accessible systems? 

A. Enable cookies to track who has accessed certain websites. 
B. Ensure procedural documentation is in place on how to access website consoles. 
C. Ensure marketing team trainings are required so that any changes to the website go through proper review. 
D. Enable administrative access roles to those that need them so that only those people can post items to the website. 

Show Answer