Cyber AB CMMC-CCP Exam Questions

Understanding NIST SP 800-88 Rev. 1 and Media SanitizationTheNIST Special Publication (SP) 800-88 Revision 1, Guidelines for Media Sanitization, provides guidance onsecure disposalof data from various types of storage media to prevent unauthorized access or recovery.

Clear

Useslogical techniquesto remove data from media, making it difficult to recover usingstandard system functions.

Example:Overwriting all datawith binary zeros or ones on a hard drive.

Applies to:Magnetic media, solid-state drives (SSD), and non-volatile memorywhen the media isreused within the same security environment.

Purge

Usesadvanced techniquesto make data recoveryinfeasible, even with forensic tools.

Example:Degaussinga magnetic hard drive orcryptographic erasure(deleting encryption keys).

Applies to:Media that is leaving organizational control or requires a higher level of assurance than 'Clear'.

Destroy

Physicallydamages the mediaso that data recovery isimpossible.

Example:Shredding, incinerating, pulverizing, or disintegratingstorage devices.

Applies to:Highly sensitive data that must be permanently eliminated.

B . Clear, Redact, Destroy (Incorrect)-- 'Redact' is a term used for document sanitization,notdata disposal.

C . Clear, Overwrite, Purge (Incorrect)-- 'Overwrite' is a method within 'Clear,' but it isnot a top-level categoryin NIST SP 800-88.

D . Clear, Overwrite, Destroy (Incorrect)-- 'Overwrite' is a sub-method of 'Clear,' but 'Purge' is missing, making this incorrect.

The correct answer isA. Clear, Purge, Destroy, as these are thethree official categoriesof data disposal inNIST SP 800-88 Revision 1.

NIST SP 800-88 Rev. 1 -- Guidelines for Media Sanitization

CMMC 2.0 Security Practices Related to Media Disposal(Aligned with NIST guidance)

Who is Responsible for Marking CUI?According toDoDI 5200.48 (Controlled Unclassified Information (CUI)), the responsibility for marking CUI falls on theauthorized holder of the information.

Definition of an Authorized Holder

PerDoDI 5200.48, Section 3.4, anauthorized holderis anyone who has beengranted accessto CUI and is responsible for handling, safeguarding, and marking it according toDoD CUI policy.

The authorized holder may be:

ADoD employee

Acontractorhandling CUI

Anyorganization or individual authorizedto access and manage CUI

DoD Guidance on CUI Marking Responsibilities

DoDI 5200.48, Section 4.2:

The individual creating or handling CUImust apply the appropriate markings as per the DoD CUI Registry guidelines.

DoDI 5200.48, Section 5.2:

Themarking responsibility is NOT limited to a specific positionlike an Information Disclosure Official or a high-level DoD office.

Instead, it is theresponsibility of the person or entity generating, handling, or disseminatingthe CUI.

Why the Other Answer Choices Are Incorrect:

(A) DoD OUSD (Office of the Under Secretary of Defense):

The OUSD plays apolicy-setting rolebut doesnot directly mark CUI.

(C) Information Disclosure Official:

This role is responsible forpublic release of information, but marking CUI is the duty of theauthorized holdermanaging the data.

(D) Presidential authorized Original Classification Authority (OCA):

OCAs classifynational security information (Confidential, Secret, Top Secret), not CUI, which isnot classified information.

Step-by-Step Breakdown:Final Validation from DoDI 5200.48:PerDoDI 5200.48, authorized holders are explicitly responsible for marking CUI, making this the correct answer.

Understanding Federal Contract Information (FCI) and Publicly Accessible InformationFederal Contract Information (FCI)isnon-public informationprovided by or generated for the U.S. governmentunder a contractthat isnot intended for public release.

Key Characteristics of FCI:FCI includesdetails related togovernment contracts, project specifics, and performance data.

It must be protected under FAR 52.204-21, which requiresbasic safeguarding measuresto prevent unauthorized access.

Posting FCI on a public site is a security violationsince it ismeant to be restrictedfrom public disclosure.

A . FCI Correct

FCI must be protected from unauthorized access, and if it wasincorrectly published online, it should have been restricted.

B . Change of leadership in the organization Incorrect

Leadership changes are typically public informationand do not require restriction unless they involve sensitive government-related security clearances.

C . Launching of their new business service line Incorrect

Marketing and business announcementsare generallypublicly availableandnot restricted information.

D . Public releases identifying major deals signed with commercial entities Incorrect

Commercial contracts and business deals are not considered FCIunless they involvegovernment contracts.

Why is the Correct Answer 'A. FCI (Federal Contract Information)'?

FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)

DefinesFCI as sensitive but unclassified informationthat must beprotected from public disclosure.

CMMC 2.0 Level 1 Requirements

Requires contractors toprotect FCI under basic cybersecurity standardsto prevent unauthorized exposure.

DoD Guidance on FCI Protection

States thatpublishing FCI on public websites violates federal cybersecurity requirements.

CMMC 2.0 Reference Supporting This Answer:

Understanding Evidence Sufficiency in CMMC Level 2 AssessmentsDuring aCMMC Level 2 Assessment, theLead Assessormust determine whether the evidence collected for each practice issufficientto support an assessment finding. This aligns with theCMMC Assessment Process (CAP) Guide, which requires assessors to evaluate:

Examinations-- Reviewing documents, configurations, and system records.

Interviews-- Speaking with personnel to confirm implementation and understanding.

Testing-- Observing security controls in action to validate effectiveness.

To determine whether evidence issufficient, the assessor ensures that it:

Directly supports the assessment objective.

Demonstrates that the practice is consistently implemented.

Can be independently verified.

Sufficiencyrefers to whetherenoughevidence has been collected to make an accurate determination about compliance.

Option A (Adequacy)is incorrect because adequacy relates tothe qualityof evidence, while sufficiency focuses on whetherenoughevidence exists.

Option C (Process Mapping)is incorrect because process mapping is used for understanding workflows but is not an assessment verification method.

Option D (Assessment Scope)is incorrect because defining the scope happensbeforeevidence collection, during the planning phase.

CMMC Assessment Process (CAP) Guide -- Section 3.6 (Determining Sufficiency of Evidence)

CMMC Level 2 Assessment Guide -- Evidence Collection and Evaluation

Why Option B (Sufficiency) is CorrectOfficial CMMC Documentation ReferenceFinal VerificationSince theLead Assessor is ensuring enough evidence is available to verify compliance, the correct answer isOption B: Sufficiency.

CMMC Level 2 Assessment MethodsCMMC Level 2 assessments focus on verifying compliance withNIST SP 800-171 requirements. TheCMMC Assessment Process (CAP) Documentspecifies that assessments at this level include:

Examination-- Reviewing documents, mechanisms, and activities.

Interview-- Speaking with personnel to validate implementation.

Testing-- Observing and verifying security controls in action.

What Does 'Examination' Include?According toCMMC Assessment Methodology, examination involves reviewing:

Documents(Policies, procedures, security plans)

Mechanisms(Security controls, authentication systems)

Activities(Backup operations, network monitoring, security training)

Sinceexamination includes reviewing documents, mechanisms, and activities, the correct answer isA.

B . Specific hardware, software, or firmware safeguards employed within a system.Incorrect. While safeguardsmaybe examined, CMMC does not limit examination to only hardware, software, or firmware. The definition is broader.

C . Policies, procedures, security plans, penetration tests, and security requirements.Incorrect. Whilesome of these itemsare examined, penetration tests arenot requiredin a CMMC Level 2 assessment.

D . Observation of system backup operations, exercising a contingency plan, and monitoring network traffic.Incorrect. These activities fall undertesting and interviews, not just examination.

Why the Other Answers Are Incorrect

CMMC Assessment Process (CAP) Document-- Defines 'examination' as reviewingdocuments, mechanisms, and activities.

CMMC Official ReferenceThus,option A (documents, mechanisms, or activities) is the correct answer, as it aligns with CMMC Level 2 assessment methodology.