CMMC-CCP Free Practice Test

A test or demonstration is being performed for the Assessment Team during an assessment. Which environment MUST the OSC perform this test or demonstration?

1. A. Client
2. B. Production
3. C. Development
4. D. Demonstration

Correct Answer: B

Which regulation allows for whistleblowers to sue on behalf of the federal government?

1. A. NISTSP 800-53
2. B. NISTSP 800-171
3. C. False Claims Act
4. D. Code of Professional Conduct

Correct Answer: C

While conducting a CMMC Assessment, a Lead Assessor is given documentation attesting to Level 1 identification and authentication practices by the OSC. The Lead Assessor asks the CCP to review the documentation to determine if identification and authentication controls are met. Which documentation BEST satisfies the requirements of IA.L1-3.5.1: Identify system users. processes acting on behalf of users, and devices?

1. A. Procedures for implementing access control lists
2. B. List of unauthorized users that identifies their identities and roles
3. C. User names associated with system accounts assigned to those individuals
4. D. Physical access policy that state
5. E. "All non-employees must wear a special visitor pass or be escorted."

Correct Answer: C

Ethics is a shared responsibility between:

1. A. DoD and CMMC-AB.
2. B. OSC and sponsors.
3. C. CMMC-AB and members of the CMMC Ecosystem.
4. D. members of the CMMC Ecosystem and Lead Assessors.

Correct Answer: C

A Lead Assessor has been assigned to a CMMC Assessment During the assessment, one of the assessors approaches with a signed policy. There is one signatory, and that person has since left the company. Subsequently, another person was hired into that position but has not signed the document. Is this document valid?

1. A. The signatory is the authority to implement and enforce the policy, and since that person is no longer with the company, the policy is not valid.
2. B. More research on the company policy of creating, implementing, and enforcing policies is neede
3. C. If the company has a policy identifying the authority as with the position or person, then the policy is valid.
4. D. The signatory does not validate or invalidate the polic
5. E. For the purpose of this assessment, ensuring that the policy is current and is being implemented by the individuals who are performing the work is sufficient.
6. F. The authority to implement and enforce lies with the position, not the perso
7. G. As long as that position's authority and responsibilities have not been removed from implementing that domain, it is still a valid policy.

Correct Answer: B