Instant Access CyberAB.CMMC-CCP.v2026-10-15.q155 Actual Practice Test Engine for Free (Page 4)

Question 11

An assessment is being completed at a client site that is not far from the Lead Assessor's home office. The client provides a laptop for the duration of the engagement. During a meeting with the network engineers, the Lead Assessor requests information about the network. They respond that they have a significant number of drawings they can provide via their secure cloud storage service. The Lead Assessor returns to their home office and decides to review the documents. What is the BEST way to retrieve the documents?

A.Log into the secure cloud storage service to save copies of the documents on both the work and client laptops.
B.Log into the client VPN from the client laptop and retrieve the documents from the secure cloud storage service.
C.Log into the client VPN from the assessor's laptop and retrieve the documents from the secure cloud storage service.
D.Use their home office workstation to retrieve the documents from the secure cloud storage service and save them to a USB stick.

Correct Answer: B

Best Practices for Handling Sensitive Assessment InformationCMMC assessments involve handlingsensitive and potentially CUI-related documents. Assessors must follow strictsecurity policiesto avoid unauthorized access, data leaks, or non-compliance withCMMC 2.0 and NIST SP 800-171 requirements.
Why Logging into the Client VPN on the Client Laptop is the Best Approach:
Ensures Data Protection:The client laptop is likely configured to meet security controls required for handling assessment-related materials.
Prevents Data Spillage:Keeping all assessment-related activities within the client's secured environment reduces the risk ofdata leakage or unauthorized storage.
Maintains Compliance with CMMC/NIST Guidelines:Using aproperly configured client laptop and secured connectionensures compliance withNIST SP 800-171 controls on secure remote access(Requirement3.13.12).
A). "Log into the secure cloud storage service to save copies of the documents on both the work and client laptops." Incorrect#Sensitive data should not be duplicated across multiple systems, especially a non-client-approved laptop. Storing it on an unauthorized systemviolates data handling best practices.
C). "Log into the client VPN from the assessor's laptop and retrieve the documents from the secure cloud storage service." Incorrect# Theassessor's laptop may not be authorizedorsecuredto handle client data. CMMC guidelines emphasizeusing approved, secured systemsfor assessment-related information.
D). "Use their home office workstation to retrieve the documents from the secure cloud storage service and save them to a USB stick." Incorrect# Transferring sensitive documents via USBintroduces security risks, including unauthorized data storage and potential malware contamination.
Home office workstationsare unlikely to be authorized for handling CMMC-sensitive data.
References:NIST SP 800-171 Rev. 2, Control 3.13.12 ("Use of Secure Remote Access") CMMC 2.0 Level 2 Assessment Process Guide(Cyber AB) DoD CUI Handling Guidelines(DoD CIO)
#Final Answer B. Log into the client VPN from the client laptop and retrieve the documents from the secure cloud storage service.

Question 12

An organization's sales representative is tasked with entering FCI data into various fields within a spreadsheet on a company-issued laptop. This laptop is an FCI Asset being used to:

A.process and transmit FCI.
B.process and organize FCI.
C.store, process, and transmit FCI.
D.store, process, and organize FCI.

Question 13

While conducting a CMMC Assessment, an individual from the OSC provides documentation to the assessor for review. The documentation states an incident response capability is established and contains information on incident preparation, detection, analysis, containment, recovery, and user response activities. Which CMMC practice is this documentation attesting to?

A.IR.L2-3.6.1: Incident Handling
B.IR.L2-3.6.2: Incident Reporting
C.IR.L2-3.6.3: Incident Response Testing
D.IR.L2-3.6.4: Incident Spillage

Question 14

Within the CMMC Ecosystem which organization ultimately will manage and oversee the training, testing, authorization, and certification of candidate assessors and instructors?

A.CMMC Assessors and Instructors Certification Organization
B.DoDOUSD
C.DIB Collaborative Information Sharing Environment
D.Committee on National Security Systems Instructions

Question 15

Ethics is a shared responsibility between:

A.DoD and CMMC-AB.
B.OSC and sponsors.
C.CMMC-AB and members of the CMMC Ecosystem.
D.members of the CMMC Ecosystem and Lead Assessors.

Question 11

Question 12

Question 13

Question 14

Question 15

Download PDF File