更新された2025年04月合格させるCMMC-CCP試験リアル練習テスト問題
無料ダウンロードCyber AB CMMC-CCPリアル試験問題
質問 # 85
In preparation for a CMMC Level 1 Self-Assessment, the IT manager for a DIB organization is documenting asset types in the company's SSP The manager determines that identified machine controllers and assembly machines should be documented as Specialized Assets. Which type of Specialized Assets has the manager identified and documented?
- A. Test equipment
- B. Operational technology
- C. loT
- D. Restricted IS
正解：B
質問 # 86
According to the Configuration Management (CM) domain, which principle is the basis for defining essential system capabilities?
- A. Least functionality
- B. Essential concern
- C. Separation of duties
- D. Least privilege
正解：A
質問 # 87
A client uses an external cloud-based service to store, process, or transmit data that is reasonably believed to qualify as CUI. According to DFARS clause 252.204-7012. what set of established security requirements MUST that cloud provider meet?
- A. FedRAMP Secure
- B. FedRAMP High
- C. FedRAMP Moderate
- D. FedRAMP Low
正解：C
質問 # 88
SC.L2-3 13.14: Control and monitor the use of VoIP technologies is marked as NOT APPLICABLE for an OSC's assessment. How does this affect the assessment scope?
- A. Any existing telephone system is in scope even if it is not using VoIP technology.
- B. An error has been made and the Lead Assessor should be contacted to correct the error.
- C. VoIP technology is within scope, and it uses FlPS-validated encryption, so it does not need to be assessed.
- D. VoIP technology is not used within scope boundary, so no assessment procedures are specified for this practice.
正解：D
質問 # 89
A CCP is working as an Assessment Team Member on a CMMC Level 2 Assessment. The Lead Assessor has assigned the CCP to assess the OSC's Configuration Management (CM) domain. The CCP's first interview is with a subject-matter expert for user-installed software. With respect to user-installed software, what facet should the CCP's interview focus on?
- A. Limited to mission-essential use only
- B. Controlled and monitored
- C. Scanned for malicious code
- D. Removed from the system
正解：A
質問 # 90
When assessing an OSC for CMMC: the Lead Assessor should use the information from the Discussion and Further Discussion sections in each practice because it:
- A. provides additional information to facilitate the assessment of the practice.
- B. contains examples that an OSC must implement.
- C. is mandatory and aligns with FAR Clause 52.204-21.
- D. is normative for an OSC to follow.
正解：A
質問 # 91
Within the CMMC Ecosystem which organization ultimately will manage and oversee the training, testing, authorization, and certification of candidate assessors and instructors?
- A. DoDOUSD
- B. DIB Collaborative Information Sharing Environment
- C. CMMC Assessors and Instructors Certification Organization
- D. Committee on National Security Systems Instructions
正解：C
質問 # 92
A company is working with a CCP from a contracted CMMC consulting company. The CCP is asked where the Host Unit is required to document FCI and CUI for a CMMC Assessment. How should the CCP respond?
- A. "Within the hardware inventory, data (low diagram, and in the network diagram"
- B. "In the SSP. within the asset inventory, and in the network diagranY'
- C. "In the network diagram, in the SSP. within the base inventory, and in the proposal response'"
- D. "Within the asset inventory, in the proposal response, and in the network diagram"
正解：B
質問 # 93
Which code or clause requires that a contractor is meeting the basic safeguarding requirements for FCI during a Level 1 Self-Assessment?
- A. 22CFR 120-130
- B. FAR 52.204-21
- C. DFARS 252.204-7021
- D. DFARS 252.204-7011
正解：B
質問 # 94
The IT manager is scoping the company's CMMC Level 1 Self-Assessment. The manager considers which servers, laptops. databases, and applications are used to store, process, or transmit FCI. Which asset type is being considered by the IT manager?
- A. Facilities
- B. ESP
- C. People
- D. Technology
正解：D
質問 # 95
How are the Final Recommended Assessment Findings BEST presented?
- A. Using a C3PAO-provided template that is preferred by the OSC
- B. Using a C3PAO-branded version of the CMMC Findings Brief template
- C. Using the CMMC Findings Brief template
- D. Using the proprietary template created by the Lead Assessor after approval from the C3PAO
正解：C
質問 # 96
Which statement BEST describes the requirements for a C3PA0?
- A. An accredited C3PAO must meet all DoD and some ISO/IEC 17020 requirements.
- B. A C3PAO must be authorized by CMMC-AB before being able to conduct assessments.
- C. An authorized C3PAO must meet some DoD and all ISO/IEC 17020 requirements.
- D. AC3PAO must be accredited by DoD before being able to conduct assessments.
正解：B
質問 # 97
At which CMMC Level do the Security Assessment (CA) practices begin?
- A. Level 4
- B. Level 1
- C. Level 3
- D. Level 2
正解：D
質問 # 98
Which organization is the governmental authority responsible for identifying and marking CUI?
- A. Department of Homeland Security
- B. CMMC-AB
- C. NIST
- D. NARA
正解：D
質問 # 99
An assessment is being completed at a client site that is not far from the Lead Assessor's home office. The client provides a laptop for the duration of the engagement. During a meeting with the network engineers, the Lead Assessor requests information about the network. They respond that they have a significant number of drawings they can provide via their secure cloud storage service. The Lead Assessor returns to their home office and decides to review the documents. What is the BEST way to retrieve the documents?
- A. Log into the client VPN from the assessor's laptop and retrieve the documents from the secure cloud storage service.
- B. Log into the secure cloud storage service to save copies of the documents on both the work and client laptops.
- C. Use their home office workstation to retrieve the documents from the secure cloud storage service and save them to a USB stick.
- D. Log into the client VPN from the client laptop and retrieve the documents from the secure cloud storage service.
正解：D
質問 # 100
An OSC lead has provided company information, identified that they are seeking CMMC Level 2, stated that they handle FCI. identified stakeholders, and provided assessment logistics. The OSC has provided the company's cyber hygiene practices that are posted on every workstation, visitor logs, and screenshots of the configuration of their FedRAMP-approved applications. The OSC has not won any DoD government contracts yet but is working on two proposals Based on this information, which statement BEST describes the CMMC Level 2 Assessment requirements?
- A. Ready because there is no need to certify this company until after they win a DoD contract.
- B. Ready because all DoD contractors are required to achieve CMMC Level 2; therefore, they are being proactive in seeking certification.
- C. Not ready because the OSC still lacks artifacts that prove they have implemented all the CMMC Level
2 Assessment requirements. - D. Not ready because the OSC is not on contract because they do not know the scope of FCI protection required by the contract.
正解：C
質問 # 101
Which NIST SP defines the Assessment Procedure leveraged by the CMMC?
- A. NISTSP800-53a
- B. NISTSP800-171a
- C. NIST SP 800-171
- D. NIST SP 800-53
正解：B
質問 # 102
An assessor needs to get the most accurate answers from an OSC's team members. What is the BEST method to ensure that the OSC's team members are able to describe team member responsibilities?
- A. Ensure confidentiality and non-attribution of team members.
- B. Interview groups of people to get collective answers.
- C. Understand that testing is more important that interviews.
- D. Let team members know the questions prior to the assessment.
正解：A
質問 # 103
A C3PAO is conducting High Level Scoping for an OSC that requested an assessment Which term describes the people, processes, and technology that will be applied to the contract who are requesting a CMMC Level assessment?
- A. Branch Office
- B. Host Unit
- C. Coordinating Unit
- D. Supporting Organization/Units
正解：D
質問 # 104
An employee is the primary system administrator for an OSC. The employee will be a core part of the assessment, as they perform most of the duties in managing and maintaining the systems. What would the employee be BEST categorized as?
- A. Applicable staff
- B. Analyzer
- C. Inspector
- D. Demonstration staff
正解：A
質問 # 105
......
CMMC-CCP問題集100パー合格保証には最新のサンプル：https://jp.fast2test.com/CMMC-CCP-premium-file.html
あなたを合格させる試験には100%確認済みCMMC-CCP試験問題：https://drive.google.com/open?id=1BjtHzWFeLF8d4XkaTtgD3CNt6Q49U8r7