Pass Cyber AB CMMC-CCP With ValidExam Exam Dumps – Updated on Oct-2026 [Q142-Q159]

Section	Weight	Objectives
Scoping	15%
CMMC Assessment Process (CAP)	25%
CMMC-AB Code of Professional Conduct (Ethics)	5%
CMMC Model Construct and Implementation Evaluation	35%
CMMC Ecosystem	5%	– Roles and responsibilities across the CMMC ecosystem
CMMC Governance and Source Documents	15%

Q142. A company is working with a CCP from a contracted CMMC consulting company. The CCP is asked where the Host Unit is required to document FCI and CUI for a CMMC Assessment. How should the CCP respond?

“In the SSP. within the asset inventory, and in the network diagranY’

“Within the hardware inventory, data (low diagram, and in the network diagram”

“Within the asset inventory, in the proposal response, and in the network diagram”

“In the network diagram, in the SSP. within the base inventory, and in the proposal response'”

Q143. In late September. CA.L2-3.12.1: Periodically assess the security controls in organizational systems to determine if the controls are effective in their application is assessed. Procedure specifies that a security control assessment shall be conducted quarterly. The Lead Assessor is only provided the first quarter assessment report because the person conducting the second quarter’s assessment is currently out of the office and will return to the office in two hours. Based on this information, the Lead Assessor should determine that the evidence is;

sufficient, and rate the audit finding as MET

insufficient, and rate the audit finding as NOT MET.

sufficient, and re-rate the audit finding after a quarter two assessment report is examined.

insufficient, and re-rate the audit finding after a quarter two assessment report is examined.

Q144. Which regulation allows for whistleblowers to sue on behalf of the federal government?

NISTSP 800-53

NISTSP 800-171

False Claims Act

Code of Professional Conduct

Understanding the False Claims Act (FCA) and Whistleblower ProtectionsTheFalse Claims Act (FCA)(31 U.
S).C. §§ 3729-3733) is aU.S. federal lawthat allowswhistleblowers (also known as “relators”)to sue on behalf of the federal government if they believe a company issubmitting fraudulent claimsfor government funds.
The FCA includes a”qui tam” provision, which:
#Allows private individuals to file lawsuits on behalf of the U.S. government.
#Provides financial rewards to whistleblowersif the lawsuit results in recovered funds.
#Protects whistleblowers from employer retaliation.
In the context ofCMMC and cybersecurity compliance, theFCA has been used to hold companies accountableformisrepresenting their cybersecurity compliancewhen working with federal contracts.
For example:
If a companyfalsely claimscompliance withCMMC, NIST SP 800-171, or DFARS 252.204-7012butfails to meet security requirements, it could beliable under the FCA.
TheDepartment of Justice (DOJ)has pursued cases under theCyber-Fraud Initiative, using theFCA against defense contractorsfor cybersecurity noncompliance.
Thus, the correct answer isC. False Claims Actbecause it specifically allows whistleblowers tosue on behalf of the federal government.
A). NIST SP 800-53#Incorrect.NIST SP 800-53provides security controls for federal agencies butdoes notcontain whistleblower provisions.
B). NIST SP 800-171#Incorrect.NIST SP 800-171outlines security requirements for protectingCUI, but itdoes not have legal mechanismsfor whistleblower lawsuits.
D). Code of Professional Conduct#Incorrect. TheCMMC Code of Professional Conductapplies toC3PAOs and assessorsbut doesnot provide a legal basis for whistleblower lawsuits.
Why the Other Answers Are Incorrect
False Claims Act (31 U.S.C. §§ 3729-3733)- Establishes whistleblower protections and qui tam lawsuits.
DOJ Cyber-Fraud Initiative- Uses the FCA to enforce cybersecurity compliance in government contracts.
DFARS 252.204-7012 & CMMC- Require accurate reporting of cybersecurity compliance, which can lead to FCA violations if misrepresented.
CMMC Official ReferencesThus,option C (False Claims Act) is the correct answeras per official legal guidance.

Q145. Which training is a CCI authorized to deliver through an approved CMMC LTP?

CMMC-AB approved training

DoD DFARS and CMMC-AB approved training

NARA CUI training and CMMC-AB approved training

DoD DFARS, NARA CUI, and CMMC-AB approved training

Q146. Which MINIMUM Level of certification must a contractor successfully achieve to receive a contract award requiring the handling of CUI?

Level 1

Level 2

Level 3

Any level

Q147. Which statement is NOT a measure to determine if collected evidence is sufficient?

Evidence covers the sampled organization

Evidence is not required if the practice is ISO certified

Evidence covers the model scope of the Assessment (Target CMMC Level)

Evidence corresponds to the sampled organization in the evidence collection approach

Q148. A dedicated local printer is used to print out documents with FCI in an organization. This is considered an FCI Asset Which function BEST describes what the printer does with the FCI?

Encrypt

Manage

Process

Distribute

Q149. How does the CMMC define a practice?

A business transaction

A condition arrived at by experience or exercise

A series of changes taking place in a defined manner

An activity or activities performed to meet defined CMMC objectives

Q150. An Assessment Team is conducting a Level 2 Assessment at the request of an OSC. The team has begun to score practices based on the evidence provided. At a MINIMUM what is required of the Assessment Team to determine if a practice is scored as MET?

All three types of evidence are documented for every control.

Examine and accept evidence from one of the three evidence types.

Complete one of the following; examine two artifacts, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.

Complete two of the following: examine one artifact, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.

This question pertains to theminimum evidence requirementsneeded by a CMMCAssessment Teamto score a practice asMETduring aLevel 2 Assessment.
The CMMC Level 2 assessment must align withNIST SP 800-171and follow the procedures outlined in theCMMC Assessment Process (CAP) Guide v1.0, particularly aroundevidence collection and scoring methodology.
#Step 1: Refer to the CMMC Assessment Process (CAP) Guide v1.0CAP v1.0 – Section 3.5.4: Evaluate Evidence and Score Practices”To assign a MET determination, the Assessment Team must collect and corroborate at least two types of objective evidence: either through examination of artifacts, interviews (affirmation), or testing (demonstration).” This meansat least two typesof the following evidence are required:
Examine(documentation/artifacts),
Interview(affirmation from personnel),
Test(demonstration of implementation).
#Step 2: Clarify the Official Minimum Standard for a Practice to be Scored METThe CAP explicitly states:
“A practice can only be scored MET when a minimum oftwo types of evidencefrom the E-I-T (Examine, Interview, Test) triad are successfully collected and evaluated.” Theevidence types must come from two different categories, for example:
An artifact(Examine)+ an interview affirmation(Interview),
A demonstration(Test)+ an interview(Interview),
Etc.
This cross-validation ensures that the control isimplemented, documented, and understoodby personnel – a core principle in assessing effective cybersecurity implementation.
#Why the Other Options Are IncorrectA. All three types of evidence are documented for every control#Incorrect:While collecting all three types (E-I-T) strengthens the assessment, theminimum requirementis onlytwo. Collecting all three isnot requiredfor a practice to be scoredMET.
B). Examine and accept evidence from one of the three evidence types#Incorrect:This fails to meet theminimum two-evidence-type requirementset by the CAP. Single-source evidence is not sufficient to score a practice as MET.
C). Complete one of the following; examine two artifacts, observe one demonstration, or receive one affirmation#Incorrect:Even if two artifacts are examined,this is still only one type of evidence(Examine). The CAP requires twotypes- not two instances of the same type.
#Why D is CorrectD. Complete two of the following: examine one artifact, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.
# This directly reflects theCAP’s requirement for collecting two different types of objective evidenceto determine a practice is MET.
BLUF (Bottom Line Up Front):To score a CMMC Level 2 practice asMET, the Assessment Team must collecta minimum of two distinct types of evidence- from theExamine, Interview, Test (E-I-T)categories.
This requirement is clearly stated in the CMMC Assessment Process (CAP) v1.0.

Q151. What is the primary intent of the verify evidence and record gaps activity?

Map test and demonstration responses to CMMC practices.

Conduct interviews to test process implementation knowledge.

Determine the one-to-one relationship between a practice and an assessment object.

Identify and describe differences between what the Assessment Team required and the evidence collected.

Understanding the “Verify Evidence and Record Gaps” Activity in a CMMC Assessment During aCMMC Level 2 Assessment, theAssessment Teamfollows a structured methodology toverify evidenceand determine whether theOrganization Seeking Certification (OSC)has met all required practices.
One of the key activities in this process is ” Verify Evidence and Record Gaps ” , which ensures that the assessment findings accurately reflect any missing or inadequate compliance evidence.
Step-by-Step Breakdown:
#1. Primary Intent: Identifying Gaps Between Required and Collected Evidence TheAssessment Teamcompares the evidence provided by the OSC against theCMMC practice requirements.
If evidence ismissing, insufficient, or inconsistent, assessors mustdocument the gapand describe what is lacking.
This ensures that compliance deficiencies are clearly identified, allowing the OSC to understand what must be corrected.
#2. How This Process Works in a CMMC Assessment
Assessorsreview collected documentation, system configurations, policies, and interview responses.
They verify that the evidencematches the expected implementationof a practice.
If gaps exist, they arerecordedfor discussion and potential remediation before assessment completion.
#3. Why the Other Answer Choices Are Incorrect:
(A) Map test and demonstration responses to CMMC practices.#
Incorrect:While mapping evidence to CMMC practices is part of the assessment, theprimary intentof the ” Verify Evidence and Record Gaps ” step is toidentify deficiencies, not just mapping responses.
(B) Conduct interviews to test process implementation knowledge.#
Incorrect:Interviews are a method used during evidence collection, but they arenot the primary focusof the verification and gap analysis step.
(C) Determine the one-to-one relationship between a practice and an assessment object.# Incorrect:The assessment teamreviews multiple sources of evidencefor each practice, and some practices require multiple assessment objects. The goal isnot a strict one-to-one mappingbut rathera holistic validation of compliance.
Final Validation from CMMC Documentation:
TheCMMC Assessment Process Guidestates that ” Verify Evidence and Record Gaps ” is the step where assessorscompare expected evidence against what has been provided and document discrepancies. This ensurestransparent assessment findings and remediation planning.
Thus, the correct answer is:
D). Identify and describe differences between what the Assessment Team required and the evidence collected.

Q152. Where does the requirement to include a required practice of ensuring that personnel are trained to carry out their assigned information security-related duties and responsibilities FIRST appear?

Level 1

Level 2

Level 3

All levels

Q153. During the planning phase of a CMMC Level 2 Assessment, the Lead Assessor is considering what would constitute the right evidence for each practice. What is the Assessor attempting to verify?

Adequacy

Sufficiency

Process mapping

Assessment scope

Q154. Which example represents a Specialized Asset?

SOCs

Hosted VPN services

Consultants who provide cybersecurity services

All property owned or leased by the government

According to the CMMC Scoping Guidance, Level 2, assets are categorized into specific groups to determine how they are treated during an assessment. One of these categories is Specialized Assets.
The CMMC Scoping Guidance defines Specialized Assets as a specific group that includes:
Government Property: Any property owned or leased by the government and provided to the contractor (Government Furnished Equipment or GFE).
Internet of Things (IoT): Physical objects that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data.
Operational Technology (OT): Programmable systems or devices that interact with the physical environment (e.g., Industrial Control Systems).
Restricted Information Systems: Systems that have specific configurations or constraints that prevent standard security controls from being applied (e.g., legacy systems).
Test Equipment: Specialized equipment used for testing, such as oscilloscopes or signal generators.
Why other options are incorrect:
Option A (SOCs): A Security Operations Center is typically considered a Security Protection Asset (SPA) because it provides security functions (monitoring/response) for the assessment scope.
Option B (Hosted VPN services): These are generally categorized as External Service Providers (ESPs) or part of the Security Protection Assets, depending on how they are managed and their role in protecting CUI.
Option C (Consultants): These are External Service Providers (ESP) (personnel/organizations), not specialized hardware/software assets.
Treatment of Specialized Assets: Under CMMC Level 2 scoping rules, Specialized Assets must be identified in the Asset Inventory and documented in the System Security Plan (SSP), but they are generally not managed against the CMMC practices unless they process, store, or transmit CUI in a way that falls outside their specialized function.
Reference Documents:
CMMC Scoping Guidance, Level 2 (Version 2.0/2.1): Section 3.1, “Specialized Assets” and Table 3.
32 CFR Part 170 (CMMC Program Rule): Definitions of asset categories and their associated assessment requirements.

Q155. An organization’s sales representative is tasked with entering FCI data into various fields within a spreadsheet on a company-issued laptop. This laptop is an FCI Asset being used to:

process and transmit FCI.

process and organize FCI.

store, process, and transmit FCI.

store, process, and organize FCI.

Q156. An organization’s sales representative is tasked with entering FCI data into various fields within a spreadsheet on a company-issued laptop. This laptop is an FCI Asset being used to:

process and transmit FCI.

process and organize FCI.

store, process, and transmit FCI.

store, process, and organize FCI.

Q157. Which statement BEST describes the requirements for a C3PA0?

An authorized C3PAO must meet some DoD and all ISO/IEC 17020 requirements.

An accredited C3PAO must meet all DoD and some ISO/IEC 17020 requirements.

AC3PAO must be accredited by DoD before being able to conduct assessments.

A C3PAO must be authorized by CMMC-AB before being able to conduct assessments.

Q158. What is the LAST step when developing an assessment plan for an OSC?

Verify the readiness to conduct the assessment.

Perform certification assessment readiness review.

Update the assessment plan and schedule as needed

Obtain and record commitment to the assessment plan.

Q159. As part of CMMC 2.0, the change to Level 1 Self-Assessments supports “reduced assessment costs” allows all companies at Level 1 (Foundational) to:

to conduct self-assessments.

opt out of CMMC Assessments.

have assessment costs reimbursed by the DoD.

pay no more than $500.00 for their annual assessment.