Free CyberAB CMMC-CCP Exam Questions

After completing a Level 2 Assessment, a C3PAO is preparing to upload the Assessment Results Package to Enterprise Mission Assurance Support Service. Which document MUST be included as part of the final assessment results package?

A. Final Report

B. Certification rating

C. Summary-level findings

D. All Daily Checkpoint logs

For the purpose of determining scope, what needs to be included as part of the assessment but would NOT receive a CMMC certification unless an enterprise assessment is conducted?

A. ESP

B. People

C. Test equipment

D. Government property

Which authority leads the CMMC direction, standards, best practices, and knowledge framework for how to map the controls and processes across different Levels that range from basic cyber hygiene to advanced cyber practices?

A. NIST

B. DoD CIO office

C. Federal CIO office

D. Defense Federal Acquisition Regulation Council

The Lead Assessor is presenting the Final Findings Presentation to the OSC. During the presentation, the Assessment Sponsor and OSC staff inform the assessor that they do not agree with the assessment results. Who has the final authority for the assessment results?

A. C3PAO

B. CMMC-AB

C. Assessment Team

D. Assessment Sponsor

In the CMMC Model, how many practices are included in Level 2?

A. 17 practices

B. 72 practices

C. 110 practices

D. 180 practices

An OSC needs to be assessed on RA.L2-3.11.1: Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. What is in scope for a Level 2 assessment of RA.L2-3.11.1?

A. IT systems

B. Enterprise systems

C. CUI Marking processes

D. Processes, people, physical entities, and IT systems in which CUI processed, stored, or transmitted

When assessing SI.L2-3.14.6: Monitor communications for attack, the CCA interviews the person responsible for the intrusion detection system and examines relevant policies and procedures for monitoring organizational systems. What would be a possible next step the CCA could conduct to gather sufficient evidence?

A. Conduct a penetration test

B. Interview the intrusion detection system's supplier.

C. Upload known malicious code and observe the system response.

D. Review an artifact to check key references for the configuration of the IDS or IPS practice for additional guidance on intrusion detection and prevention systems.

For CMMC Assessments, during Phase 1 of the CMMC Assessment Process, which are responsible for identifying potential conflicts of information?

A. C3PAO and OSC

B. OSC and CMMC-AB

C. CMMC-AB and C3PAO

D. Lead Assessor and Assessment Team Members

During the assessment process, who is the final interpretation authority for recommended findings?

A. C3PAO

B. CMMC-AB

C. OSC sponsor

D. Assessment Team Members

Who will verify the adequacy and sufficiency of evidence to determine whether the practices and related components for each in-scope Host Unit. Supporting Organization/Unit, or enclave has been met?

A. OSC

B. Assessment Team

C. Authorizing official .

D. Assessment official