Instant Access CyberAB.CMMC-CCP.v2026-10-15.q155 Actual Practice Test Engine for Free (Page 32)

Question 151

What activities are conducted while developing an assessment plan?

A.The C3PAO decides the Assessment Team members and notifies the Lead Assessor.
B.The Lead Assessor and the OSC's sponsor determine the assessment resources and schedule.
C.The C3PAO's project manager is responsible for handling potential conflicts of interest.
D.The evidence collection approach can be finalized when the Lead Assessor conducts an onsite assessment.

Question 152

Who is responsible for ensuring that subcontractors have a valid CMMC Certification?

A.CMMC-AB
B.OUSDA & S
C.DoD agency or client
D.Contractor organization

Question 153

According to the Configuration Management (CM) domain, which principle is the basis for defining essential system capabilities?

A.Least privilege
B.Essential concern
C.Least functionality
D.Separation of duties

Correct Answer: C

Understanding the Principle of Least Functionality in the CM Domain
TheConfiguration Management (CM) domainin CMMC 2.0 focuses on maintaining the security and integrity of an organization's systems through controlled configurations and restrictions on system capabilities.
The principle ofLeast Functionalityrefers to limiting a system's features, services, and applications to only those necessary for its intended purpose. This principle reduces the attack surface by minimizing unnecessary components that could be exploited by attackers.
Justification for the Correct Answer: Least Functionality (C)
CMMC Practice CM.L2-3.4.6 (Use Least Functionality)explicitly states:
"Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities." Thegoalis to prevent unauthorized or unnecessary applications, services, and ports from running on the system.
Examples of Implementation:
Disabling unnecessary services, such as remote desktop access if not required.
Restricting software installation to approved applications.
Blocking unused network ports and protocols.
Why Other Options Are Incorrect
A). Least Privilege
This principle (associated with Access Control) ensures that users and processes have only the minimum level of access necessary to perform their jobs.
It is relevant to CMMC PracticeAC.L2-3.1.5 (Least Privilege)but does not define system capabilities.
B). Essential Concern
There is no officially recognized cybersecurity principle called "Essential Concern" in CMMC, NIST, or related frameworks.
D). Separation of Duties
This principle (covered under CMMCAC.L2-3.1.4) ensures that no single individual has unchecked control over critical functions, reducing the risk of fraud or abuse.
While important for security, it does not define essential system capabilities.
Official CMMC and NIST References
CMMC 2.0 Level 2 Assessment Guide - Configuration Management (CM) Domain CM.L2-3.4.6 mandatesleast functionalityto enhance security by removing unnecessary features.
NIST SP 800-171 (which CMMC is based on) - Requirement 3.4.6
States:"Limit system functionality to only the essential capabilities required for organizational missions or business functions." NIST SP 800-53 - Control CM-7 (Least Functionality) Provides detailed recommendations on configuring systems to operate with only necessary features.
Conclusion
Theprinciple of Least Functionality (C)is the basis for defining essential system capabilities in theConfiguration Management (CM) domainof CMMC 2.0. By applying this principle, organizations reduce security risks by ensuring that only the necessary functions, services, and applications are enabled.

Question 154

A CMMC Assessment is being conducted at an OSC's HQ. which is a shared workspace in a multi-tenant building. The OSC is renting four offices on the first floor that can be locked individually. The first-floor conference room is shared with other tenants but has been reserved to conduct the assessment. The conference room has a desk with a drawer that does not lock. At the end of the day, an evidence file that had been sent by email is reviewed. What is the BEST way to handle this file?

A.Review it, print it, make notes, and then shred it in cross-cut shredder in the print room.
B.Review it. print it, and put it in the desk drawer.
C.Review it, and make notes on the computer provided by the client.
D.Review it. print it, and leave it in a folder on the table together with the other documents.

Question 155

In the CMMC Model, how many practices are included in Level 1?

A.15 practices
B.17 practices
C.72 practices
D.110 practices

Correct Answer: B

CMMC (Cybersecurity Maturity Model Certification) 2.0 Level 1 is designed to protectFederal Contract Information (FCI)and consists of17 foundational cybersecurity practices. These practices are directly derived fromFAR 52.204-21(Basic Safeguarding of Covered Contractor Information Systems), which outlines minimum security requirements for contractors handling FCI.
Breakdown of CMMC Level 1 PracticesThe17 practicesin Level 1 focus on basic cybersecurity hygiene and fall under the following6 domains:
* Access Control (AC)- 4 practices
* AC.L1-3.1.1: Limit system access to authorized users
* AC.L1-3.1.2: Limit user access to authorized transactions and functions
* AC.L1-3.1.20: Verify and control connections to external systems
* AC.L1-3.1.22: Control information posted or processed on publicly accessible systems
* Identification and Authentication (IA)- 2 practices
* IA.L1-3.5.1: Identify and authenticate system users
* IA.L1-3.5.2: Use multifactor authentication for local and network access
* Media Protection (MP)- 1 practice
* MP.L1-3.8.3: Sanitize media before disposal or reuse
* Physical Protection (PE)- 4 practices
* PE.L1-3.10.1: Limit physical access to systems containing FCI
* PE.L1-3.10.3: Escort visitors and monitor visitor activity
* PE.L1-3.10.4: Maintain audit logs of physical access
* PE.L1-3.10.5: Control and manage physical access devices
* System and Communications Protection (SC)- 2 practices
* SC.L1-3.13.1: Monitor and control communications at system boundaries
* SC.L1-3.13.5: Implement subnetworks for publicly accessible system components
* System and Information Integrity (SI)- 4 practices
* SI.L1-3.14.1: Identify, report, and correct system flaws in a timely manner
* SI.L1-3.14.2: Provide protection from malicious code at designated locations
* SI.L1-3.14.4: Update malicious code protection mechanisms periodically
* SI.L1-3.14.5: Perform scans of system components and real-time file scans Official Reference from CMMC 2.0 DocumentationThe 17 practices forCMMC Level 1are explicitly listed in theCMMC 2.0 Appendices and Assessment Guide for Level 1, as well as in theFAR 52.204-21 requirements.
These practices representbasic safeguarding measuresthat all DoD contractors handlingFCImust implement.
#CMMC 2.0 Level 1 Summary:
* Focus:Basic safeguarding of FCI
* Total Practices:17
* Derived From:FAR 52.204-21
* Assessment Type:Self-assessment (annual)
Final Verification and ConclusionThe correct answer isB. 17 practicesas verified from theCMMC 2.0 official documentsandFAR 52.204-21 requirements.

Question 151

Question 152

Question 153

Question 154

Question 155

Download PDF File