Cyber AB CCP - Certified CMMC Professional Exam
Page: 3 / 41
Total 201 questions
Question #11 (Topic: Exam A)
What is DFARS clause 252.204-7012 required for?
A. All DoD solicitations and contracts
B. Solicitations and contracts that use FAR part 12 procedures
C. Procurements solely for the acquisition of commercial off-the-shelf
D. Commercial off-the-shelf sold in the marketplace without modifications
Answer: A
Question #12 (Topic: Exam A)
A contractor provides services and data to the DoD. The transactions that occur to handle FCI take place over the contractor’s business network, but the work is performed on contractor-owned systems, which must be configured based on government requirements and are used to support a contract. What type of Specialized Asset are these systems?
A. IoT
B. Restricted IS
C. Test equipment
D. Government property
Answer: B
Question #13 (Topic: Exam A)
During a Level 2 Assessment, an OSC provides documentation that attests that they utilize multifactor authentication on nonlocal remote maintenance sessions. The OSC feels that they have met the controls for the Level 2 certification. What additional measures should the OSC perform to fully meet the maintenance requirement?
A. Connections for nonlocal maintenance sessions should be terminated when maintenance is complete.
B. Connections for nonlocal maintenance sessions should be unlimited to ensure maintenance is performed properly.
C. The nonlocal maintenance personnel complain that restrictions slow down their response time and should be removed.
D. The maintenance policy states multifactor authentication must have at least two factors applied for nonlocal maintenance sessions.
Answer: A
Question #14 (Topic: Exam A)
While developing an assessment plan for an OSC, it is discovered that the certified assessor will be interviewing a former college roommate. What is the MOST correct action to take?
A. Do not inform the OSC and the C3PAO of the possible conflict of interest, and continue as planned.
B. Inform the OSC and the C3PAO of the possible conflict of interest, and start the entire process over without the conflicted team member.
C. Inform the OSC and the C3PAO of the possible conflict of interest but since it has been an acceptable amount of time since college, no conflict of interest exists, and continue as planned.
D. Inform the OSC and the C3PAO of the possible conflict of interest, document the conflict and mitigation actions in the assessment plan, and if the mitigation actions are acceptable, continue with the assessment.
Answer: D
Question #15 (Topic: Exam A)
Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1, Guidelines for Media Sanitation?
A. Clear, purge, destroy
B. Clear, redact, destroy
C. Clear, overwrite, purge
D. Clear, overwrite, destroy
Answer: A
