Question 1

When assessing an OSC for CMMC: the Lead Assessor should use the information from the Discussion and Further Discussion sections in each practice because it:

Options :

A : is normative for an OSC to follow.

B : contains examples that an OSC must implement.

C : is mandatory and aligns with FAR Clause 52.204-21.

D : provides additional information to facilitate the assessment of the practice.

Answer: D

Question 2

Which domain has a practice requiring an organization to restrict, disable, or prevent the use of nonessential programs?

Options :

A : Access Control (AC)

B : Media Protection (MP)

C : Asset Management (AM)

D : Configuration Management (CM)

Answer: D

Question 3

The CMMC Level 2 assessment methods include examination and can include:

Options :

A : documents, mechanisms, or activities.

B : specific hardware, software, or firmware safeguards employed within a system.

C : policies, procedures, security plans, penetration tests, and security requirements.

D : observation of system backup operations, exercising a contingency plan, and monitoring network traffic.

Answer: C

Question 4

Ethics is a shared responsibility between:

Options :

A : DoD and CMMC-AB.

B : OSC and sponsors.

C : CMMC-AB and members of the CMMC Ecosystem.

D : members of the CMMC Ecosystem and Lead Assessors.

Answer: C

Question 5

An OSC receives an email with "CUI//SP-PRVCY//FED Only" in the body of the message Which organization's website should the OSC go to identify what this marking means?

Options :

A : NARA

B : CMMC-AB

C : DoD Contractors FAQ page

D : DoD 239.7601 Definitions page

Answer: A

Free CMMC-CCP Mock Exam – Practice Online Confidently

Buying Options: