Question 1

Which MINIMUM Level of certification must a contractor successfully achieve to receive a contract award requiring the handling of CUI?

Accepted Answer

B

Explanation: The Cybersecurity Maturity Model Certification (CMMC) framework is structured in three levels. Level 2 (Advanced) is the minimum certification level required for contractors who handle Controlled Unclassified Information (CUI). This level's requirements are directly aligned with the 110 security controls specified in NIST SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." Level 1 is designed only for protecting Federal Contract Information (FCI), which has less stringent safeguarding requirements than CUI. Therefore, to be awarded a contract involving CUI, an organization must demonstrate compliance with at least Level 2.

Question 2

In the Code of Professional Conduct, what does the practice of Professionalism require?

Accepted Answer

C

Explanation: The Cyber AB Code of Professional Conduct (CoPC) outlines several core tenets that certified professionals must adhere to. The tenet of "Professionalism" is explicitly defined as the requirement to "Refrain from any and all forms of dishonesty in all dealings regarding CMMC." This principle establishes a foundation of integrity, truthfulness, and ethical behavior, which is paramount for maintaining the credibility of the CMMC ecosystem and the professionals who operate within it.

Question 3

During the planning phase of the Assessment Process. C3PAO staff are reviewing the various entities
associated with an OSC that has requested a CMMC Level 2 Assessment. Which term describes the
people, processes, and technology external to the HQ Organization that participate in the
assessment but will not receive a CMMC Level unless an enterprise Assessment is conducted?

Accepted Answer

D

Explanation: In the context of the CMMC Assessment Process, a "Supporting Organization/Unit" refers to an external entity that provides people, processes, or technology to the Organization Seeking Certification (OSC). These supporting elements are included within the assessment scope because they handle, process, or protect Controlled Unclassified Information (CUI) on behalf of the OSC. However, the supporting organization itself does not receive a CMMC certification from the OSC's assessment. Its compliance is evaluated solely in relation to the services it provides to the OSC. This is a common scenario with External Service Providers (ESPs) like cloud vendors or managed service providers.

Question 4

Which words summarize categories of data disposal described in the NIST SP 800-88 Revision 1. Guidelines for Media Sanitation?

Accepted Answer

A

Explanation: NIST Special Publication 800-88 Revision 1, "Guidelines for Media Sanitation," explicitly defines three categories of sanitization to counter data remanence. These categories are Clear, Purge, and Destroy. 'Clear' involves using logical techniques to sanitize data against simple recovery tools. 'Purge' uses physical or logical techniques to make data recovery infeasible even with advanced laboratory methods. 'Destroy' renders the media completely unusable and unable to store data again, making data recovery impossible. These three terms form the foundational framework for media sanitization decisions within the standard.

Question 5

A client uses an external cloud-based service to store, process, or transmit data that is reasonably
believed to qualify as CUI. According to DFARS clause 252.204-7012. what set of established security
requirements MUST that cloud provider meet?

Accepted Answer

B

Explanation: The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting," directly addresses the security requirements for external cloud service providers (CSPs). Paragraph (b)(2)(ii)(D) of this clause mandates that if a contractor uses an external CSP to store, process, or transmit Covered Defense Information (CDI), which includes CUI, the contractor must ensure the CSP meets security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. This ensures a consistent and adequate level of protection for sensitive defense information hosted in the cloud.

Question 6

Which term describes the prevention of damage to. protection of, and restoration of computers and
electronic communications systems/services, including information contained therein, to ensure its
availability, integrity, authentication, confidentiality, and nonrepudiation?

Accepted Answer

A

Explanation: The definition provided in the question is the official definition of "Cybersecurity" used by the U.S. Government, including the Department of Defense (DoD). It precisely describes the protection of digital assets ("computers and electronic communications systems") and the data they contain. This definition is comprehensive, covering not only the classic Confidentiality, Integrity, and Availability (CIA) triad but also the crucial aspects of Authentication and Nonrepudiation, which are fundamental to modern digital security practices and are explicitly called out in the CMMC framework's underlying standards.

Question 7

During Phase 4 of the Assessment process, what MUST the Lead Assessor determine and recommend to the C3PAO concerning the OSC?

Accepted Answer

B

Explanation: During Phase 4 (Closeout) of the CMMC assessment, the Lead Assessor, on behalf of the C3PAO, finalizes the assessment results. This involves confirming that the Organization Seeking Certification (OSC) has met all applicable CMMC practices and objectives for the target level. The final recommendation submitted to the C3PAO is a formal attestation of whether the OSC has met the stringent, predefined criteria of the CMMC standard. This determination of meeting all requirements is fundamentally a conclusion on the OSC's eligibility for certification.

Question 8

There are 15 practices that are NOT MET for an OSC's Level 2 Assessment. All practices are applicable to the OSC. Which determination should be reached?

Accepted Answer

B

Explanation: The CMMC Assessment Process (CAP) specifies that an OSC can receive a conditional Level-2 certification with POA&Ms only when the total number of NOT MET practices “does not exceed 10 percent of the practices within scope.” For Level 2, 110 practices are always in scope; 10 percent equals 11. Because the OSC failed 15 practices—exceeding this 11-practice ceiling—it is automatically ineligible for the remediation/POA&M option. The correct determination therefore is that no option to remediate is available.

Question 9

Which code or clause requires that a contractor is meeting the basic safeguarding requirements for FCI during a Level 1 Self-Assessment?

Accepted Answer

A

Explanation: CMMC Level 1 (Foundational) is focused on the protection of Federal Contract Information (FCI). The 15 security practices required for a Level 1 Self-Assessment are taken directly from the basic safeguarding requirements stipulated in Federal Acquisition Regulation (FAR) clause 52.204-21, "Basic Safeguarding of Covered Contractor Information Systems." This FAR clause is the foundational contractual requirement for all federal contractors to protect FCI on their nonfederal information systems. Therefore, it is the specific clause that requires a contractor to meet these basic safeguarding requirements.

Question 10

A company is about to conduct a press release. According to AC.L1-3.1.22: Control information
posted or processed on publicly accessible systems, what is the MOST important factor to consider
when addressing CMMC requirements?

Accepted Answer

C

Explanation: The CMMC practice AC.L1-3.1.22, "Control information posted or processed on publicly accessible systems," is fundamentally about preventing the unauthorized disclosure of sensitive government information. At CMMC Level 1, the focus is on protecting Federal Contract Information (FCI). A press release is posted on a publicly accessible system (e.g., a company website). Therefore, the most critical factor from a CMMC perspective is to ensure that the information being released has been reviewed and authorized to prevent the spillage of FCI, which is defined as information not intended for public release.

Question 11

As defined in the CMMC-AB Code of Professional Conduct, what term describes any contract between two legal entities?

Accepted Answer

D

Explanation: The Cyber AB Code of Professional Conduct, in its definitions section, explicitly defines the term "Agreement" as "Any contract between two legal entities." This definition is used throughout the document to establish the scope of contractual and ethical obligations for individuals and organizations certified or accredited by the Cyber AB. The code uses this specific term to ensure clarity and consistent application of its principles regarding professional relationships and commitments.

Question 12

Contractor scoping requirements for a CMMC Level 2 Assessment to document the asset in an inventory, in the SSP and on the network diagram apply to:

Accepted Answer

C

Explanation: According to the CMMC Level 2 Scoping Guide, all assets within the CMMC Assessment Scope must be documented. This scope explicitly includes CUI Assets, Security Protection Assets (SPAs), Contractor Risk Managed Assets (CRMAs), and Specialized Assets. For each of these categories, the contractor is required to document the asset in the asset inventory, describe it in the System Security Plan (SSP), and depict it on the network diagram. The only category exempt from these documentation requirements is Out-of-Scope Assets, which are, by definition, outside the assessment boundary.

Question 13

What is the BEST description of the purpose of FAR clause 52 204-21?

Accepted Answer

C

Explanation: FAR clause 52.204-21, "Basic Safeguarding of Covered Contractor Information Systems," establishes the fundamental, or minimum, cybersecurity requirements that contractors must implement to protect Federal Contract Information (FCI) on their information systems. The clause lists 15 basic security controls that represent a foundational level of cyber hygiene. This set of controls constitutes the minimum acceptable "standard of care" for any contractor handling FCI, as opposed to a comprehensive list of all possible safeguards or a mandate for specific commercial products or advanced certifications.

Question 14

An Assessment Team is reviewing a practice that is documented and being checked monthly. When
reviewing the logs, the practice is only being completed quarterly. During the interviews, the team
members say they perform the practice monthly but only document quarterly. Is this sufficient to
pass the practice?

Accepted Answer

C

Explanation: For a CMMC practice to be assessed as "MET," the evidence gathered must be sufficient and consistent across all applicable assessment methods (Examine, Interview, and Test). In this scenario, there is a direct conflict between the objective evidence obtained from the 'Examine' method (logs show quarterly activity) and the testimonial evidence from the 'Interview' method (staff claim monthly activity). This inconsistency means the evidence is not sufficient to verify that the practice is implemented as required. Therefore, the practice would be assessed as "NOT MET."

Question 15

Plan of Action defines the clear goal or objective for the plan. What information is generally NOT a part of a plan of action?

Accepted Answer

D

Explanation: A Plan of Action and Milestones (POA&M) is a formal document used to track and manage the remediation of identified security weaknesses. According to foundational standards like NIST SP 800-53, which heavily influences CMMC, a POA&M's essential components include a description of the weakness, the responsible individual or office (ownership), key milestones, and scheduled completion dates. While the plan may identify the resources required (e.g., personnel, technology), it does not typically contain detailed, line-item budget requirements. Budgeting is a related but separate organizational financial planning process that enables the remediation actions described in the POA&M.

Free Cyber AB CMMC-CCP Actual Exam Questions