Free CyberAB CMMC-CCP Exam Questions

Who is responsible for identifying and verifying Assessment Team Member qualifications?

A. C3PAO

B. CMMC-AB

C. Lead Assessor

D. CMMC Marketplace

A C3PAO is near completion of a Level 2 Assessment for an OSC. The CMMC Findings Brief and CMMC Assessment Results documents have been developed. The Final Recommended Assessment Results are being generated. When generating these results, what MUST be included?

A. An updated Assessment Plan

B. Recorded and final updated Daily Checkpoint

C. Fully executed CMMC Assessment contract between the C3PAO and the OSC .

D. Review documentation for the CMMC Quality Assurance Professional (CQAP)

In the Code of Professional Conduct, what does the practice of Professionalism require?

A. Do not copy materials without permission to do so.

B. Do not make assertions about assessment outcomes.

C. Refrain from dishonesty in all dealings regarding CMMC.

D. Ensure the security of all information discovered or received.

Which assessment method compares actual-specified conditions with expected behavior?

A. Test

B. Examine

C. Compile

D. Interview

During Phase 4 of the Assessment process, what MUST the Lead Assessor determine and recommend to the C3PAO concerning the OSC?

A. Ability

B. Eligibility

C. Capability

D. Suitability

A CCP is working as an Assessment Team Member on a CMMC Level 2 Assessment. The Lead Assessor has assigned the CCP to assess the OSC's Configuration Management (CM) domain. The CCP's first interview is with a subject-matter expert for user-installed software. With respect to user-installed software, what facet should the CCP's interview focus on?

A. Controlled and monitored

B. Removed from the system

C. Scanned for malicious code

D. Limited to mission-essential use only

A company is about to conduct a press release. According to AC.L1-3.1.22: Control information posted or processed on publicly accessible systems, what is the MOST important factor to consider when addressing CMMC requirements?

A. That the information is correct

B. That the CEO approved the message

C. That the company has to safeguard the release of FCI

D. That so long as the information is only FCI, it can be released

The facilities manager for a company has procured a Wi-Fi enabled, mobile applicationcontrolled thermostat for the server room, citing concerns over the inability to remotely gauge and control the temperature of the room. Because the thermostat is connected to the company's FCI network, should it be assessed as part of the CMMC Level 1 Self- Assessment Scope?

A. No, because it is OT

B. No, because it is an loT device

C. Yes. because it is a restricted IS

D. Yes, because it is government property

Within how many days from the Assessment Final Recommended Findings Brief should the Lead Assessor and Assessment Team Members, if necessary, review the accuracy and validity of (he OSC's updated POA&M with any accompanying evidence or scheduled collections?

A. 90 days

B. 180 days

C. 270 days

D. 360 days

A C3PAO Assessment Plan document captures the names of the interviewees, the facilities that will utilized, along with estimated costs and schedule of the assessment. What part of the assessment plan is this?

A. Identify resources and schedule.

B. Select Assessment Team members.

C. Identify and manage assessment risks.

D. Select and develop the evidence collection approach.