Free Cyber AB CMMC-CCP Practice Test & Real Exam Questions

According to DFARS clause 252.204-7012, who is responsible for determining that Information in a given category should be considered CUI?

An Assessment Team Member is conducting a CMMC Level 2 Assessment for an OSC that is in the process of inspecting Assessment Objects for AC.L1-3.1.1: Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) to determine the adequacy of evidence provided by the OSC. Which Assessment Method does this activity fall under?

What is the primary intent of the verify evidence and record gaps activity?

An assessment procedure consists of an assessment objective, potential assessment methods, and assessment objects. Which statement is part of an assessment objective?

A CCP is part of a CMMC Assessment Team interviewing a subject-matter expert on Access Control (AC) within an OSC. During the interview process, what will the CCP ensure about the information exchanged during the interview?

An Assessment Team is reviewing a practice that is documented and being checked monthly. When reviewing the logs, the practice is only being completed quarterly. During the interviews, the team members say they perform the practice monthly but only document quarterly. Is this sufficient to pass the practice?

Who is responsible for ensuring that subcontractors have a valid CMMC Certification?

How does the CMMC define a practice?

Which resource contains authoritative data classifications of CUI?

Ethics is a shared responsibility between:

An OSC has submitted evidence for an upcoming assessment. The assessor reviews the evidence and determines it is not adequate or sufficient to meet the CMMC practice. What can the assessor do?

Which term describes a group of individuals that conduct operational network vulnerability evaluations and provide mitigation techniques to customers?

A contractor has implemented IA.L2-3.5.3: Multifactor Authentication practice for their privileged users, however, during the assessment it was discovered that the OSC ' s standard users do not require MFA to access their endpoints and network resources. What would be the BEST finding?