Free Cyber AB CMMC CMMC-CCP Ultimate Study Guide (Updated 238 Questions) [Q61-Q84]

Rate this post

Free Cyber AB CMMC CMMC-CCP Ultimate Study Guide (Updated 238 Questions)

Get to the Top with CMMC-CCP Practice Exam Questions

Cyber AB CMMC-CCP Exam Syllabus Topics:

Topic	Details
Topic 1	CMMC-AB Code of Professional Conduct (Ethics): This section of the exam measures the integrity of cybersecurity professionals by evaluating their understanding of the CMMC-AB Code of Professional Conduct. It emphasizes ethical responsibilities, including confidentiality, objectivity, professionalism, conflict-of-interest avoidance, and respect for intellectual property, ensuring candidates can uphold ethical standards throughout their CMMC-related duties.
Topic 2	CMMC Assessment Process (CAP): This section of the exam measures the planning and execution skills of audit and assessment professionals, covering the end-to-end CMMC Assessment Process. This includes planning, executing, documenting, reporting assessments, and managing Plans of Action and Milestones (POA&M) in alignment with DoD and CMMC-AB methodology.
Topic 3	Scoping: This section of the exam measures the analytical skills of cybersecurity practitioners, highlighting their ability to properly define assessment scope. Candidates must demonstrate knowledge of identifying and classifying Controlled Unclassified Information (CUI) assets, recognizing the difference between in-scope, out-of-scope, and specialized assets, and applying logical and physical separation techniques to determine accurate scoping for assessments

NO.61 A cyber incident is discovered that affects a covered contractor IS and the CDI residing therein. How long does the contractor have to inform the DoD?

24 hours

48 hours

72 hours

96 hours

NO.62 Companies that knowingly defraud the government by not being in compliance with cybersecurity regulations are at risk of being held liable for:

The contract value plus a penalty as stated in the Cyber Claims Act

The contract value plus a penalty as stated in the False Claims Act

Three times the contract value plus a penalty as stated in the Cyber Claims Act

Three times the contract value plus a penalty as stated in the False Claims Act

NO.63 During a Level 1 Self-Assessment, a smart thermostat was identified. It is connected to the Internet on the OSC’s WiFi network. What type of asset is this?

FCI Asset

CUI Asset

In-scope Asset

Specialized Asset

NO.64 The Advanced Level in CMMC will contain Access Control {AC) practices from:

Level 1.

Level 3.

Levels 1 and 2.

Levels 1,2, and 3.

NO.65 A Level 2 Assessment was conducted for an OSC, and the results are ready to be submitted. Prior to uploading the assessment results, what step MUST the C3PAO complete?

Pay an assessment submission fee.

Complete an internal review of the results.

Notify the CMMC-AB that submission is forthcoming.

Coordinate a final briefing between the Lead Assessor and the OSC.

NO.66 A test or demonstration is being performed for the Assessment Team during an assessment. Which environment MUST the OSC perform this test or demonstration?

Client

Production

Development

Demonstration

NO.67 A CCP is working as an Assessment Team Member on a CMMC Level 2 Assessment. The Lead Assessor has assigned the CCP to assess the OSC’s Configuration Management (CM) domain. The CCP’s first interview is with a subject-matter expert for user-installed software. With respect to user-installed software, what facet should the CCP’s interview focus on?

Controlled and monitored

Removed from the system

Scanned for malicious code

Limited to mission-essential use only

NO.68 Recording evidence as adequate is defined as the criteria needed to:

verify, based on an assessment and organizational scope.

verify, based on an assessment and organizational practice.

determine if a given artifact, interview response, demonstration, or test meets the CMMC scope.

determine if a given artifact, interview response, demonstration, or test meets the CMMC practice.

Understanding “Adequate Evidence” in the CMMC Assessment ProcessIn aCMMC assessment,adequate evidencerefers to the proof required to demonstrate that a specific cybersecurity practice has been implemented correctly. Evidence can come from:
* Artifacts(e.g., security policies, system configurations, logs).
* Interview responses(e.g., verbal confirmation from personnel about their responsibilities).
* Demonstrations(e.g., showing how a security control is implemented in real time).
* Testing(e.g., verifying technical security mechanisms such as multi-factor authentication).
Thegoalof evidence collection is to determinewhether a CMMC practice is met-not just whether the organization operates within the assessment scope.
* A. Verify, based on an assessment and organizational scope # Incorrect
* Theassessment scopedefineswhat is evaluated, but adequacy of evidence is based oncompliance with specific CMMC practices.
* B. Verify, based on an assessment and organizational practice # Incorrect
* CMMC assessments focus on cybersecurity practices defined in the CMMC framework, not just general organizational practices.
* C. Determine if a given artifact, interview response, demonstration, or test meets the CMMC scope # Incorrect
* Thescopedefines the assessment boundaries, but theassessment team’s job is to confirm whether CMMC practices are satisfied.
* D. Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice # Correct
* TheCMMC assessment process focuses on ensuring that required practices are implemented, making this the correct answer.
Why is the Correct Answer “Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice” (D)?
* CMMC Assessment Process (CAP) Document
* Defines “adequate evidence” asproof that a CMMC practice has been correctly implemented.
* CMMC 2.0 Assessment Criteria
* Specifies that evidence must beevaluated against specific cybersecurity practices.
* NIST SP 800-171A (Assessment Procedures for NIST SP 800-171)
* Provides guidance on evaluating artifacts, interviews, demonstrations, and testing to confirm compliance with required practices.
CMMC 2.0 References Supporting this Answer:
Final Answer:#D. Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice.

NO.69 The IT manager is scoping the company’s CMMC Level 1 Self-Assessment. The manager considers which servers, laptops. databases, and applications are used to store, process, or transmit FCI. Which asset type is being considered by the IT manager?

ESP

People

Facilities

Technology

NO.70 The results package for a Level 2 Assessment is being submitted. What MUST a Final Report. CMMC Assessment Results include?

Affirmation for each practice or control

Documented rationale for each failed practice

Suggested improvements for each failed practice

Gaps or deltas due to any reciprocity model are recorded as met

NO.71 While conducting a CMMC Assessment, an individual from the OSC provides documentation to the assessor for review. The documentation states an incident response capability is established and contains information on incident preparation, detection, analysis, containment, recovery, and user response activities. Which CMMC practice is this documentation attesting to?

IR.L2-3.6.1: Incident Handling

IR.L2-3.6.2: Incident Reporting

IR.L2-3.6.3: Incident Response Testing

IR.L2-3.6.4: Incident Spillage

NO.72 When planning an assessment, the Lead Assessor should work with the OSC to select personnel to be interviewed who could:

have a security clearance.

be a senior person in the company.

demonstrate expertise on the CMMC requirements.

provide clarity and understanding of their practice activities.

Interview Selection in CMMC AssessmentsDuring aCMMC assessment, theLead Assessormust work with theOrganization Seeking Certification (OSC)to select personnel for interviews. The goal is to:
#Verify that personnel understand andperform security-related practices.
#Ensure that individuals canexplain how they implement CMMC requirements.
#Gain insight intoactual cybersecurity operationsrather than just documented policies.
The best interviewees are those whodirectly engage with security practicesand canclearly explain how they perform their duties.
CMMC assessmentsrely on interviewsto validate that security practices areimplemented effectively.
Themost valuable intervieweesare those who canexplainhow security measures are appliedin day-to-day operations.
CMMC Assessment Process (CAP)emphasizes that assessors should speak tothose actively involved in security practicesrather than just senior management or policy owners.
Why “Providing Clarity and Understanding” Is KeyThus,option D is the correct choicebecause the Lead Assessor should prioritizeinterviewing personnel who can clearly explain how CMMC practices are implemented.
A). Have a security clearance.#Incorrect.Security clearance is not a requirementfor CMMC assessments. The focus is onpractical implementation of security controls, not classified work.
B). Be a senior person in the company.#Incorrect. Senior executives may not be involved in theactual implementation of security controls. The best interviewees are those whoperform the work, not just oversee it.
C). Demonstrate expertise on the CMMC requirements.#Incorrect. Whileunderstanding CMMC is important, expertise alonedoes not guarantee practical knowledgeof security controls. The key is thatinterviewees must provide clarity on how they perform security tasks.
Why the Other Answers Are Incorrect
CMMC Assessment Process (CAP) Document- Guides interview selection based on personnel who perform security functions.
NIST SP 800-171 & CMMC 2.0- Emphasize that cybersecurity controls must beactively implemented, not just documented.
CMMC Official ReferencesThus,option D (Provide clarity and understanding of their practice activities) is the correct answeras per official CMMC assessment guidelines.

NO.73 Which code or clause requires that a contractor is meeting the basic safeguarding requirements for FCI during a Level 1 Self-Assessment?

FAR 52.204-21

22CFR 120-130

DFARS 252.204-7011

DFARS 252.204-7021

NO.74 A contractor stores security policies, system configuration files, and audit logs in a centralized file repository for later review. According to CMMC terminology, the file repository is being used to:

protect CUI.

transmit CUI.

store CUI.

generate CUI

NO.75 Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1. Guidelines for Media Sanitation?

Clear, purge, destroy

Clear redact, destroy

Clear, overwrite, purge

Clear, overwrite, destroy

NO.76 What is the legal entity under a contract that has agreed to deliver products or services?

Supporting Organization/Unit

Commercial and Government Entity Code

Host Unit

HQ Organization

NO.77 The Assessment Team has completed the assessment and determined the preliminary practice ratings. The preliminary practice ratings must be shared with the OSC prior to being finalized for submission. Based on this information, the assessor should present the preliminary practice ratings:

During the final Daily Checkpoint

After discussing with the CMMC-AB

Via email after the final Daily Checkpoint

Over the phone after the final Daily Checkpoint

According to the CMMC Assessment Process (CAP) v2.0, assessors are required to conduct Daily Checkpoint Meetings at the end of each day to summarize progress with the OSC (Organization Seeking Certification).
The final Daily Checkpoint is where preliminary practice ratings are shared, before the quality assurance review and Out-Brief. The Out-Brief is reserved for the presentation of final results. Additionally, Department of Defense regulations (32 CFR §170.17(c)(2)) provide a 10-business-day re-evaluation window for requirements marked NOT MET before the final report is delivered, which necessitates that the OSC see preliminary ratings during the assessment process itself.
Supporting Extracts from Official Content:
* CAP v2.0, §2.23: “The assessment team shall host a Daily Checkpoint Meeting with the OSC at the end of each assessment day to summarize progress.”
* CAP v2.0, §3.7: “The C3PAO shall conduct the quality assurance review… prior to the conduct of the Out-Brief Meeting.”
* CAP v2.0, §3.10: “The purpose of the Out-Brief Meeting is to convey the results of the assessment to the OSC.”
* 32 CFR §170.17(c)(2): “A security requirement assessed as NOT MET may be re-evaluated… for 10 business days… if the CMMC Assessment Findings Report has not been delivered.” Why Option A is Correct:
* The CAP specifies that Daily Checkpoint Meetings are the formal, structured mechanism for assessors to communicate progress and preliminary findings to the OSC.
* The final Daily Checkpoint provides the OSC with visibility into the preliminary practice ratings before they are finalized, ensuring transparency and alignment.
* The Out-Brief is explicitly for conveying the final assessment results after the C3PAO has completed QA.
* Federal regulation (32 CFR §170.17(c)(2)) requires the OSC to have access to preliminary results so they can provide additional evidence for re-evaluation before the report is locked, further confirming that this exchange must occur at the final Daily Checkpoint.
References (Official CMMC v2.0 Content):
* CMMC Assessment Process (CAP) v2.0: Sections 2.23 (Daily Checkpoints), 3.7-3.10 (QA and Out- Brief).
* 32 CFR §170.17(c)(2): Security Requirement Re-evaluation Window.
* DoD CMMC Assessment Guide – Level 2 (v2.13): Guidance on MET/NOT MET determinations and findings.

NO.78 Which term describes “the protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to. or modification of information”?

Adopted security

Adaptive security

Adequate security

Advanced security

Understanding the Concept of Security in CMMC 2.0
CMMC 2.0 aligns with federal cybersecurity standards, particularlyFISMA (Federal Information Security Modernization Act), NIST SP 800-171, and FAR 52.204-21. One key principle in these frameworks is the implementation of security measures that are appropriate for the risk level associated with the data being protected.
The question describes security measures that are proportionate to therisk of loss, misuse, unauthorized access, or modificationof information. This matches the definition of”Adequate Security.” Analyzing the Given Options A). Adopted security# Incorrect The term”adopted security”is not officially recognized in CMMC, NIST, or FISMA. Organizations adopt security policies, but the concept does not directly align with the question’s definition.
B). Adaptive security# Incorrect
Adaptive securityrefers to adynamic cybersecurity modelwhere security measures continuously evolve based on real-time threats. While important, it does not directly match the definition in the question.
C). Adequate security#Correct
The term”adequate security”is defined inNIST SP 800-171, DFARS 252.204-7012, and FISMAas the level of protection that isproportional to the consequences and likelihood of a security incident.
This aligns perfectly with the definition in the question.
D). Advanced security# Incorrect
Advanced securitytypically refers tohighly sophisticated cybersecurity mechanisms, such as AI-driven threat detection. However, the term does not explicitly relate to the concept of risk-based proportional security.
Official References Supporting the Correct Answer
FISMA (44 U.S.C. § 3552(b)(3))
Definesadequate securityas”protective measures commensurate with the risk and potential impact of unauthorized access, use, disclosure, disruption, modification, or destruction of information.” This directly matches the question’s wording.
DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) Mandates that contractors apply”adequate security”to protect Controlled Unclassified Information (CUI).
NIST SP 800-171 Rev. 2, Requirement 3.1.1
States that organizations must “limit system access to authorized users and implement adequate security protections to prevent unauthorized disclosure.” CMMC 2.0 Documentation (Level 1 and Level 2 Requirements) Requires that organizationsapply adequate security measures in accordance with NIST SP 800-171to meet compliance standards.
Conclusion
The term”adequate security”is the correct answer because it is explicitly defined in federal cybersecurity frameworks asprotection proportional to risk and potential consequences. Thus, the verified answer is:

NO.79 In accordance with NARA directives and Chapter 33 of Title 44 (Records Management Directive), which types of data MUST have policies and procedures for disposal?

All recorded digital documents

All digital and recorded paper documents

All digital documents and recorded media

All recorded information, regardless of form or characteristics

NO.80 There are 15 practices that are NOT MET for an OSC’s Level 2 Assessment. All practices are applicable to the OSC. Which determination should be reached?

The OSC may have 90 days for remediating NOT MET practices.

The OSC is not eligible for an option to remediate NOT MET practices.

The OSC may be eligible for an option to remediate NOT MET practices.

The OSC is not eligible for an option to remediate after the assessment is canceled.

NO.81 The Advanced Level in CMMC will contain Access Control (AC) practices from:

Level 1

Level 3

Levels 1 and 2

Levels 1, 2, and 3

NO.82 Regarding the Risk Assessment (RA) domain, what should an OSC periodically assess?

Organizational operations, business assets, and employees

Organizational operations, business processes, and employees

Organizational operations, organizational assets, and individuals

Organizational operations, organizational processes, and individuals

TheRisk Assessment (RA) domainaligns withNIST SP 800-171 control family 3.11 (Risk Assessment)and is designed to help organizationsidentify, assess, and manage cybersecurity risksthat could impact their operations.
TheRA.3.144 practice(which is a CMMC Level 2 requirement) explicitly states:
“Periodically assess therisktoorganizational operations (including mission, functions, image, or reputation), organizational assets, and individualsresulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.” This means that OSCs (Organizations Seeking Certification) should regularly evaluate risks to:
#Organizational operations(e.g., mission, business continuity, functions)
#Organizational assets(e.g., data, IT systems, intellectual property)
#Individuals(e.g., employees, contractors, customers affected by security risks) Thus, the correct answer isC. Organizational operations, organizational assets, and individuals.
* A. Organizational operations, business assets, and employees#Incorrect.”Business assets”is not the correct terminology used in CMMC/NIST SP 800-171. Instead,”organizational assets”is the proper term.
* B. Organizational operations, business processes, and employees#Incorrect.”Business processes”is not a part of the formal risk assessment requirement. The correct scope includesorganizational assetsandindividuals, not just processes.
* D. Organizational operations, organizational processes, and individuals#Incorrect. While processes are important,organizational assetsmust be considered in the assessment, not just processes.
Why the Other Answers Are Incorrect
* CMMC 2.0 Model (Level 2 – RA.3.144)- Specifies that risk assessments must coverorganizational operations, organizational assets, and individuals.
* NIST SP 800-171 (3.11.1)- Reinforces the same risk assessment scope.
CMMC Official ReferencesThus,option C (Organizational operations, organizational assets, and individuals) is the correct answerbased on official CMMC risk assessment requirements.

NO.83 When scoping a Level 2 assessment, which document is useful for understanding the process to successfully implement practices required for the various Levels of CMMC?

NISTSP 800-53

NISTSP 800-88

NISTSP 800-171

NISTSP 800-172