合格させるCyber AB CMMC CMMC-CCPテスト問題集で[2025年03月19日] 更新された172問あります
Cyber AB CMMC-CCP実際の問題と100%カバー率でリアル試験問題
質問 # 35
Plan of Action defines the clear goal or objective for the plan. What information is generally NOT a part of a plan of action?
- A. Milestones to measure progress
- B. Completion dates
- C. Ownership of who is accountable for ensuring plan performance
- D. Budget requirements to implement the plan's remediation actions
正解：C
質問 # 36
A Lead Assessor has been assigned to a CMMC Assessment During the assessment, one of the assessors approaches with a signed policy. There is one signatory, and that person has since left the company.
Subsequently, another person was hired into that position but has not signed the document. Is this document valid?
- A. More research on the company policy of creating, implementing, and enforcing policies is needed. If the company has a policy identifying the authority as with the position or person, then the policy is valid.
- B. The signatory is the authority to implement and enforce the policy, and since that person is no longer with the company, the policy is not valid.
- C. The signatory does not validate or invalidate the policy. For the purpose of this assessment, ensuring that the policy is current and is being implemented by the individuals who are performing the work is sufficient.
- D. The authority to implement and enforce lies with the position, not the person. As long as that position's authority and responsibilities have not been removed from implementing that domain, it is still a valid policy.
正解：D
質問 # 37
In late September. CA.L2-3.12.1: Periodically assess the security controls in organizational systems to determine if the controls are effective in their application is assessed. Procedure specifies that a security control assessment shall be conducted quarterly. The Lead Assessor is only provided the first quarter assessment report because the person conducting the second quarter's assessment is currently out of the office and will return to the office in two hours. Based on this information, the Lead Assessor should determine that the evidence is;
- A. insufficient, and rate the audit finding as NOT MET.
- B. sufficient, and rate the audit finding as MET
- C. insufficient, and re-rate the audit finding after a quarter two assessment report is examined.
- D. sufficient, and re-rate the audit finding after a quarter two assessment report is examined.
正解：A
質問 # 38
Which MINIMUM Level of certification must a contractor successfully achieve to receive a contract award requiring the handling of CUI?
- A. Level 1
- B. Any level
- C. Level 2
- D. Level 3
正解：A
質問 # 39
An assessment is being conducted at a remote client site. For the duration of the assessment, the client has provided a designated hoteling space in their secure facility which consists of a desk with access to a shared printer. After noticing that the desk does not lock, a locked cabinet is requested but the client does not have one available. At the end of the day, the client provides a printout copy of an important network diagram. The diagram is clearly marked and contains CUI. What should be done NEXT to protect the document?
- A. Put it in the unlocked desk drawer for review the following morning.
- B. Leave it on the desk for review the following day.
- C. Take a picture with the personal phone before securely shredding it.
- D. Take it with them to review in the evening.
正解：C
質問 # 40
While developing an assessment plan for an OSC. it is discovered that the certified assessor will be interviewing a former college roommate. What is the MOST correct action to take?
- A. Inform the OSC and the C3PAO of the possible conflict of interest but since it has been an acceptable amount of time since college, no conflict of interest exists, and continue as planned.
- B. Inform the OSC and the C3PAO of the possible conflict of interest, and start the entire process over without the conflicted team member.
- C. Do not inform the OSC and the C3PAO of the possible conflict of interest, and continue as planned.
- D. Inform the OSC and the C3PAO of the possible conflict of interest, document the conflict and mitigation actions in the assessment plan, and if the mitigation actions are acceptable, continue with the assessment.
正解：D
質問 # 41
A contractor has implemented IA.L2-3.5.3: Multifactor Authentication practice for their privileged users, however, during the assessment it was discovered that the OSC's standard users do not require MFA to access their endpoints and network resources. What would be the BEST finding?
- A. The process is running correctly.
- B. Practice is NOT MET since the objective was not implemented.
- C. It is out of scope as this is a new acquisition.
- D. The new acquisition is considered Specialized Assets.
正解：B
質問 # 42
The Assessment Team has completed Phase 2 of the Assessment Process. In conducting Phase 3 of the Assessment Process, the Assessment Team is reviewing evidence to address Limited Practice Deficiency Corrections. How should the team score practices in which the evidence shows the deficiencies have been corrected?
- A. MET
- B. NOT APPLICABLE
- C. POA&M
- D. NOT MET
正解：A
質問 # 43
During the planning phase of a CMMC Level 2 Assessment, the Lead Assessor is considering what would constitute the right evidence for each practice. What is the Assessor attempting to verify?
- A. Adequacy
- B. Sufficiency
- C. Assessment scope
- D. Process mapping
正解：B
質問 # 44
Who is responsible for identifying and verifying Assessment Team Member qualifications?
- A. Lead Assessor
- B. CMMC Marketplace
- C. C3PAO
- D. CMMC-AB
正解：C
質問 # 45
In scoping a CMMC Level 1 Self-Assessment, it is determined that an ESP employee has access to FCI. What is the ESP employee considered?
- A. Assessment Team Member
- B. In scope
- C. OSC point of contact
- D. Out of scope
正解：B
質問 # 46
A company is about to conduct a press release. According to AC.L1-3.1.22: Control information posted or processed on publicly accessible systems, what is the MOST important factor to consider when addressing CMMC requirements?
- A. That so long as the information is only FCI, it can be released
- B. That the information is correct
- C. That the company has to safeguard the release of FCI
- D. That the CEO approved the message
正解：C
質問 # 47
Exercising due care to ensure the information gathered during the assessment is protected even after the engagement has ended meets which code of conduct requirement?
- A. Availability
- B. Respect for Intellectual Property
- C. Confidentiality
- D. Information Integrity
正解：C
質問 # 48
When assessing an OSC for CMMC: the Lead Assessor should use the information from the Discussion and Further Discussion sections in each practice because it:
- A. contains examples that an OSC must implement.
- B. provides additional information to facilitate the assessment of the practice.
- C. is mandatory and aligns with FAR Clause 52.204-21.
- D. is normative for an OSC to follow.
正解：B
質問 # 49
What is the primary intent of the verify evidence and record gaps activity?
- A. Conduct interviews to test process implementation knowledge.
- B. Determine the one-to-one relationship between a practice and an assessment object.
- C. Identify and describe differences between what the Assessment Team required and the evidence collected.
- D. Map test and demonstration responses to CMMC practices.
正解：C
質問 # 50
During assessment planning, the OSC recommends a person to interview for a certain practice. The person being interviewed MUST be the person who:
- A. funds that practice.
- B. implements, performs, or supports that practice.
- C. supports, audits, and performs that practice.
- D. audits that practice.
正解：B
質問 # 51
Which document is the BEST source for determining the sources of evidence for a given practice?
- A. CMMC Assessment Scope
- B. CMMC Assessment Guide
- C. NISTSP 800-53A
- D. NISTSP 800-53
正解：C
質問 # 52
A Lead Assessor is presenting an assessment kickoff and opening briefing. What topic MUST be included?
- A. Overview of the assessment process
- B. Examination of the artifacts for sufficiency
- C. Review of the OSC's SSP
- D. Gathering evidence
正解：A
質問 # 53
Which resource contains authoritative data classifications of CUI?
- A. NARA
- B. OSC's privacy policies
- C. DoD Contractors FAQ
- D. CMMC-AB
正解：A
質問 # 54
Prior to conducting a CMMC Assessment, the contractor must specify the CMMC Assessment scope by categorizing all assets. Which two asset categories are always assessed against CMMC practices?
- A. Security Protection Assets and Contractor Risk Managed Assets
- B. Specialized Assets and Contractor Risk Managed Assets
- C. CUI Assets and Specialized Assets
- D. Security Protection Assets and CUI Assets
正解：C
質問 # 55
How many domains does the CMMC Model consist of?
- A. 43 domains
- B. 110 domains
- C. 72 domains
- D. 14 domains
正解：D
質問 # 56
Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1. Guidelines for Media Sanitation?
- A. Clear, overwrite, purge
- B. Clear, purge, destroy
- C. Clear redact, destroy
- D. Clear, overwrite, destroy
正解：B
質問 # 57
......
Cyber AB CMMC-CCPリアル2025年最新のブレーン問題集で模擬試験問題集：https://jp.fast2test.com/CMMC-CCP-premium-file.html
CMMC-CCP無料試験問題と解答PDF更新されたのは2025年03月：https://drive.google.com/open?id=1TzBg3rwZD8uvlCcCT5nGWtCibXEFpM-5