Instant Access CyberAB.CMMC-CCP.v2026-10-15.q155 Actual Practice Test Engine for Free (Page 21)

Question 96

Within how many days from the Assessment Final Recommended Findings Brief should the Lead Assessor and Assessment Team Members, if necessary, review the accuracy and validity of (he OSC's updated POA&M with any accompanying evidence or scheduled collections?

A.360 days
B.270 days
C.90 days
D.180 days

Question 97

A contractor has implemented IA.L2-3.5.3: Multifactor Authentication practice for their privileged users, however, during the assessment it was discovered that the OSC's standard users do not require MFA to access their endpoints and network resources. What would be the BEST finding?

A.The process is running correctly.
B.It is out of scope as this is a new acquisition.
C.The new acquisition is considered Specialized Assets.
D.Practice is NOT MET since the objective was not implemented.

Correct Answer: D

Understanding IA.L2-3.5.3: Multifactor Authentication (MFA) RequirementTheIA.L2-3.5.3practice, derived fromNIST SP 800-171 (Requirement 3.5.3), requires thatmultifactor authentication (MFA) be implemented for both privileged and standard userswhen accessing:
#Organizational endpoints(e.g., laptops, desktops, mobile devices).
#Network resources(e.g., VPNs, internal systems).
#Cloud services containing Controlled Unclassified Information (CUI).
Key Requirement for a "MET" RatingFor IA.L2-3.5.3 to beMet, the organization must:
* Require MFA for all privileged users(e.g., system administrators).
* Require MFA for standard users accessing endpoints and network resources.
* Implement MFA across all relevant systems.
Sincestandard users do not require MFA in the OSC's current implementation, the practiceis not fully implementedand must be ratedNOT MET.
* A. The process is running correctly # Incorrect
* MFA isonly applied to privileged users, but it isalso required for standard users. The process isnot fully implemented.
* B. It is out of scope as this is a new acquisition # Incorrect
* New acquisitionsmust still meet MFA requirementsif they handle CUI or network access.
* C. The new acquisition is considered Specialized Assets # Incorrect
* Specialized assets (e.g., IoT, legacy systems) may have alternative security controls, but standard users and endpointsmust still comply with MFA.
* D. Practice is NOT MET since the objective was not implemented # Correct
* MFA must be enabled for both privileged and standard usersaccessing endpoints and network resources. Since standard users are excluded, the practice isNOT MET.
Why is the Correct Answer "D" (Practice is NOT MET since the objective was not implemented)?
* CMMC 2.0 Level 2 (Advanced) Requirements
* Specifies thatMFA must be applied to all users accessing CUI and network resources.
* NIST SP 800-171 (Requirement 3.5.3 - MFA Implementation)
* Requires MFA forall user types, including privileged and standard users.
* CMMC Assessment Process (CAP) Document
* States that a practicemust be fully implemented to be considered MET. Partial implementation meansNOT MET.
CMMC 2.0 References Supporting This answer:

Question 98

A CCP is working as an Assessment Team Member on a CMMC Level 2 Assessment. The Lead Assessor has assigned the CCP to assess the OSC's Configuration Management (CM) domain. The CCP's first interview is with a subject-matter expert for user-installed software. With respect to user-installed software, what facet should the CCP's interview focus on?

A.Controlled and monitored
B.Removed from the system
C.Scanned for malicious code
D.Limited to mission-essential use only

Question 99

A C3PAO is conducting High Level Scoping for an OSC that requested an assessment Which term describes the people, processes, and technology that will be applied to the contract who are requesting a CMMC Level assessment?

A.Host Unit
B.Branch Office
C.Coordinating Unit
D.Supporting Organization/Units

Correct Answer: A

According to the CMMC Assessment Process (CAP), specifically in the context of scoping and organizational structure, the term Host Unit is used to define the specific entity within an Organization Seeking Certification (OSC) that is the primary subject of the assessment.
Definition of Host Unit: Within the CAP, the Host Unit represents the specific people, processes, and technology that process, store, or transmit Controlled Unclassified Information (CUI) or Federal Contract Information (FCI) for the contract in scope. It is the " anchor " for the assessment boundary.
Context in High-Level Scoping: During the initial phases of an assessment, a C3PAO must distinguish between the entire corporation (the OSC) and the specific parts of that corporation that are actually performing the DoD work. The Host Unit is that functional or logical division that will be evaluated against the CMMC practices.
Relationship to other units:
Supporting Organization/Units (Option D): These are entities that provide services to the Host Unit (such as an enterprise IT department or a separate HR branch) but are not the primary " Host " of the CUI/FCI. They are in-scope because they provide " Security Protection " or " Administrative " functions to the Host Unit.
Coordinating Unit (Option C): This term is often used in broader organizational contexts but is not a defined scoping term for the " people, processes, and technology " being assessed under the CMMC CAP.
Reference Documents:
CMMC Assessment Process (CAP) v1.0: Glossary and Section 1 (Plan and Prepare Assessment), which defines the relationship between the OSC, the Host Unit, and Supporting Units.
CMMC Level 2 Scoping Guidance: Provides the framework for identifying the " assets " (people, technology, facilities) that reside within the Host Unit boundary.
CCP Study Guide: Section on " Scoping the Assessment, " which explains how to identify the Host Unit versus External Service Providers (ESPs).

Question 100

Which term describes "the protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to. or modification of information"?

A.Advanced security
B.Adequate security
C.Adaptive security
D.Adopted security

Question 96

Question 97

Question 98

Question 99

Question 100

Download PDF File