Cyber AB CMMC-CCP Exam Questions

Step 1: Understanding CMMC Level 1 Self-Assessment Scope

CMMC Level 1applies toFederal Contract Information (FCI)systems.

Any system or device that is connected to an FCI-handling network is within the assessment scopebecause it canintroduce vulnerabilitiesinto the environment.

Step 2: Why the Thermostat is in Scope

TheWi-Fi-enabled thermostat is connected to the FCI network, meaning it haspotential accessto sensitive contract-related data.

PerCMMC Scoping Guidance, this type of device is classified as aRestricted Information System (Restricted IS)---devices that do not store, process, or transmit FCI but areconnected to networks that do.

Restricted IS must be accounted for in the self-assessment scope to ensure they do not compromise security controls.

CMMC Level 1 Scoping Guidance

CMMC Assessment Process (CAP) Guide

Step 3: Why Other Answer Choices Are Incorrect

A . No, because it is OT (Incorrect):

Operational Technology (OT)includesindustrial control systemsbut does not exempt a device from assessmentif it connects to an FCI network.

B . No, because it is an IoT device (Incorrect):

IoT (Internet of Things) devicesthat areconnected to an FCI network must be assessedto ensure they do not create security vulnerabilities.

D . Yes, because it is government property (Incorrect):

Theownershipof the device (government or company) doesnotdetermine its inclusion in the CMMC assessment scope---its network connectivity does.

Final Confirmation of Correct Answer:

The thermostat is part of the CMMC Level 1 Self-Assessment Scope as a Restricted IS.

Thus, the correct answer is:C. Yes, because it is a restricted IS

What is Required in the CMMC Assessment Kickoff and Opening Briefing?

Before starting aCMMC assessment, theLead Assessormust present anopening briefingto ensure that theOrganization Seeking Certification (OSC)understands the assessment process.

Step-by-Step Breakdown:

1. Overview of the Assessment Process

The Lead Assessormust explain the CMMC assessment methodology, including:

Theassessment objectives and scope

How theassessment team will review security controls

What to expectduring interviews, testing, and document review

This ensurestransparency and alignmentbetween the assessors and the OSC.

2. Why the Other Answer Choices Are Incorrect:

(A) Gathering Evidence

Evidence collection is part of the assessment butnot the primary topic of the opening briefing.

(B) Review of the OSC's SSP

While theSSP is a key document, reviewing it is part of the assessment,not the kickoff briefing.

(D) Examination of the artifacts for sufficiency

Artifact review happens laterin the assessment process,not during the kickoff.

Final Validation from CMMC Documentation:

TheCMMC Assessment Process Guidestates that theopening briefing must include an overview of the assessment process, ensuring the OSC understands the expectations and methodology.

Thus, the correct answer is:

C. Overview of the assessment process.

Understanding the CMMC Assessment Process (CAP) PhasesTheCMMC Assessment Process (CAP)consists ofthree primary phases:

Phase 1 - Planning(Pre-assessment activities)

Phase 2 - Conducting the Assessment(Evidence collection and analysis)

Phase 3 - Reporting and Finalizing Results

DuringPhase 3, the Assessment Teamreviews evidenceto confirm if anyLimited Practice Deficiency Correctionshave been successfully implemented.

Scoring Practices in Phase 3The CAP document specifies that a practice can bescored as METif:

The deficiency identified in Phase 2 has been fully corrected before final scoring.

Sufficient evidence is provided to demonstrate compliance with the CMMC requirement.

The correction is notmerely plannedbutfully implemented and validatedby the assessors.

Since the evidence shows thatdeficiencies have been corrected, the correct score isMET.

B . POA&M (Plan of Action & Milestones)Incorrect. APOA&M (Plan of Action and Milestones)is usedonly when a deficiency remains unresolved. Since the deficiency is already corrected, this option does not apply.

C . NOT METIncorrect. A practice is scoredNOT METonly if the deficiency hasnotbeen corrected by the end of the assessment.

D . NOT APPLICABLEIncorrect. A practice is markedNOT APPLICABLE (N/A)only if it doesnot apply to the organization's environment, which is not the case here.

Why the Other Answers Are Incorrect

CMMC Assessment Process (CAP) Document-- Defines scoring criteria for MET, NOT MET, and POA&M.

CMMC Official ReferenceThus,option A (MET) is the correct answer, as the deficiencies have been corrected before final scoring.

Understanding NIST SP 800-88 Rev. 1 and Media SanitizationTheNIST Special Publication (SP) 800-88 Revision 1, Guidelines for Media Sanitization, provides guidance onsecure disposalof data from various types of storage media to prevent unauthorized access or recovery.

Clear

Useslogical techniquesto remove data from media, making it difficult to recover usingstandard system functions.

Example:Overwriting all datawith binary zeros or ones on a hard drive.

Applies to:Magnetic media, solid-state drives (SSD), and non-volatile memorywhen the media isreused within the same security environment.

Purge

Usesadvanced techniquesto make data recoveryinfeasible, even with forensic tools.

Example:Degaussinga magnetic hard drive orcryptographic erasure(deleting encryption keys).

Applies to:Media that is leaving organizational control or requires a higher level of assurance than 'Clear'.

Destroy

Physicallydamages the mediaso that data recovery isimpossible.

Example:Shredding, incinerating, pulverizing, or disintegratingstorage devices.

Applies to:Highly sensitive data that must be permanently eliminated.

B . Clear, Redact, Destroy (Incorrect)-- 'Redact' is a term used for document sanitization,notdata disposal.

C . Clear, Overwrite, Purge (Incorrect)-- 'Overwrite' is a method within 'Clear,' but it isnot a top-level categoryin NIST SP 800-88.

D . Clear, Overwrite, Destroy (Incorrect)-- 'Overwrite' is a sub-method of 'Clear,' but 'Purge' is missing, making this incorrect.

The correct answer isA. Clear, Purge, Destroy, as these are thethree official categoriesof data disposal inNIST SP 800-88 Revision 1.

NIST SP 800-88 Rev. 1 -- Guidelines for Media Sanitization

CMMC 2.0 Security Practices Related to Media Disposal(Aligned with NIST guidance)

Who is Responsible for Marking CUI?According toDoDI 5200.48 (Controlled Unclassified Information (CUI)), the responsibility for marking CUI falls on theauthorized holder of the information.

Definition of an Authorized Holder

PerDoDI 5200.48, Section 3.4, anauthorized holderis anyone who has beengranted accessto CUI and is responsible for handling, safeguarding, and marking it according toDoD CUI policy.

The authorized holder may be:

ADoD employee

Acontractorhandling CUI

Anyorganization or individual authorizedto access and manage CUI

DoD Guidance on CUI Marking Responsibilities

DoDI 5200.48, Section 4.2:

The individual creating or handling CUImust apply the appropriate markings as per the DoD CUI Registry guidelines.

DoDI 5200.48, Section 5.2:

Themarking responsibility is NOT limited to a specific positionlike an Information Disclosure Official or a high-level DoD office.

Instead, it is theresponsibility of the person or entity generating, handling, or disseminatingthe CUI.

Why the Other Answer Choices Are Incorrect:

(A) DoD OUSD (Office of the Under Secretary of Defense):

The OUSD plays apolicy-setting rolebut doesnot directly mark CUI.

(C) Information Disclosure Official:

This role is responsible forpublic release of information, but marking CUI is the duty of theauthorized holdermanaging the data.

(D) Presidential authorized Original Classification Authority (OCA):

OCAs classifynational security information (Confidential, Secret, Top Secret), not CUI, which isnot classified information.

Step-by-Step Breakdown:Final Validation from DoDI 5200.48:PerDoDI 5200.48, authorized holders are explicitly responsible for marking CUI, making this the correct answer.