[2026年07月30日] CMMC-CCP PDFで最近更新された問題です集試験点数を伸ばそう
CMMC-CCP完全版問題集には無料PDF問題で合格させる
Cyber AB CMMC-CCP 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
質問 # 24
What is the LAST step when developing an assessment plan for an OSC?
- A. Obtain and record commitment to the assessment plan.
- B. Perform certification assessment readiness review.
- C. Verify the readiness to conduct the assessment.
- D. Update the assessment plan and schedule as needed
正解：C
解説：
Last Step in Developing an Assessment Plan for an OSCDeveloping anassessment planinvolves:
Defining the assessment scope(e.g., systems, networks, locations).
Planning test activities(e.g., interviews, evidence review, technical testing).
Verifying the OSC's readiness(e.g., ensuring required documents are available).
Updating the assessment plan and schedule as needed.
Final Step: Obtaining and recording the OSC's commitment to the assessment plan.
Why is obtaining commitment the last step?#Theassessment cannot proceed unless the OSC agrees to the finalized plan.
#This ensuresOSC leadership understands the scope, timeline, and responsibilities.
#TheC3PAO must document this commitmentto formalize the agreement.
A). Verify the readiness to conduct the assessment # Incorrect
Readiness verification happens earlierin the planning process, not as the last step.
B). Perform certification assessment readiness review # Incorrect
Areadiness review is conducted before finalizing the plan, not at the very end.
C). Update the assessment plan and schedule as needed # Incorrect
Updating the plan happens before commitment is obtained; it is not the final step.
D). Obtain and record commitment to the assessment plan # Correct
This is the final step before conducting the assessment. The OSC must formally agree to the plan.
Why is the Correct Answer "D. Obtain and record commitment to the assessment plan"?
CMMC Assessment Process (CAP) Document
States that theOSC must confirm agreement to the assessment plan before execution.
CMMC-AB Guidelines for C3PAOs
Specifies thatfinalizing the assessment plan requires documented commitment from the OSC.
CMMC Assessment Guide
Outlines thatassessments cannot begin without formal approval of the plan.
CMMC 2.0 References Supporting This Answer.
Final Answer #D. Obtain and record commitment to the assessment plan.
質問 # 25
When planning an assessment, the Lead Assessor should work with the OSC to select personnel to be interviewed who could:
- A. Be a senior person in the company
- B. Have a security clearance
- C. Demonstrate expertise on the CMMC requirements
- D. Provide clarity and understanding of their practice activities
正解：D
解説：
Per the CMMC Assessment Process (CAP), when planning an assessment, the Lead Assessor must coordinate with the Organization Seeking Certification (OSC) to select interview participants who can provide clarity and understanding of their practice activities. The intent is to interview individuals directly involved with and knowledgeable about the processes and practices under review, rather than selecting personnel based solely on rank, clearance, or formal expertise in CMMC.
This ensures the assessment is evidence-based and grounded in how practices are actually performed within the OSC.
Reference Documents:
* CMMC Assessment Process (CAP), v1.0
質問 # 26
An Assessment Team Member is conducting a CMMC Level 2 Assessment for an OSC that is in the process of inspecting Assessment Objects for AC.L1-3.1.1: Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) to determine the adequacy of evidence provided by the OSC. Which Assessment Method does this activity fall under?
- A. Examine
- B. Interview
- C. Test
- D. Observe
正解：A
質問 # 27
Two network administrators are working together to determine a network configuration in preparation for CMMC. The administrators find that they disagree on a couple of small items. Which solution is the BEST way to ensure compliance with CMMC?
- A. Consult with the CEO of the company.
- B. Go with the network administrator's ideas with the least stringent controls.
- C. Go with the network administrator's ideas with the most stringent controls.
- D. Consult the CMMC Assessment Guides and NIST SP 800-171.
正解：D
解説：
When preparing forCMMC compliance, organizations must ensure that theirnetwork configurations align with required cybersecurity controls. Ifnetwork administratorsdisagree on certain configurations, the mostobjective and accurateway to resolve the disagreement is by referencingofficial CMMC guidanceandNIST SP 800-171 requirements, which form the foundation of CMMC Level 2.
Step-by-Step Breakdown:
CMMC Assessment Guides as the Primary Reference
TheCMMC Assessment Guides (Level 1 & Level 2)provide clearinterpretationsof security practices.
Theyexplain how each practice should be implemented and assessedduring certification.
NIST SP 800-171 as the Compliance Baseline
CMMC Level 2is based directly onNIST SP 800-171, which outlines the110 security controlsrequired for protectingControlled Unclassified Information (CUI).
Network configurations must complywith NIST-defined security requirements, including:
Access Control (AC) - Ensuring least privilege principles.
Audit and Accountability (AU) - Logging and monitoring network activity.
System and Communications Protection (SC) - Secure network design and encryption.
Why the Other Answer Choices Are Incorrect:
(A) Consult with the CEO of the company:
ACEO is not necessarily a cybersecurity expertand may not be familiar with CMMC technical requirements.
Technical compliance decisions should be based onCMMC and NISTframeworks, not executive opinions.
(C) Go with the network administrator's ideas with the least stringent controls:
Choosingless stringent controls increases security riskand could lead toCMMC non-compliance.
(D) Go with the network administrator's ideas with the most stringent controls:
While security is important,more stringent controlsmay introduceoperational inefficienciesorunnecessary coststhat are not required for compliance.
The correct approach is to implement what is required by CMMC and NIST SP 800-171, no more and no less.
Final Validation from CMMC Documentation:
TheCMMC Assessment GuidesandNIST SP 800-171 Rev. 2areofficial sourcesthat provide the most reliable guidance on compliance.
CMMC Level 2 is entirely based on NIST SP 800-171, making it the definitive source for resolving security disagreements.
Thus, the correct answer is:
B). Consult the CMMC Assessment Guides and NIST SP 800-171.
質問 # 28
The facilities manager for a company has procured a Wi-Fi enabled, mobile application-controlled thermostat for the server room, citing concerns over the inability to remotely gauge and control the temperature of the room. Because the thermostat is connected to the company's FCI network, should it be assessed as partof the CMMC Level 1 Self-Assessment Scope?
- A. Yes, because it is government property
- B. No, because it is an loT device
- C. Yes. because it is a restricted IS
- D. No, because it is OT
正解：C
質問 # 29
A client uses an external cloud-based service to store, process, or transmit data that is reasonably believed to qualify as CUI. According to DFARS clause 252.204-7012. what set of established security requirements MUST that cloud provider meet?
- A. FedRAMP Secure
- B. FedRAMP Moderate
- C. FedRAMP Low
- D. FedRAMP High
正解：B
解説：
UnderDFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting), if acontractoruses acloud-based serviceto store, process, or transmitControlled Unclassified Information (CUI), the cloud providermustmeet the security requirements ofFedRAMP Moderate or equivalent.
* CUI stored in the cloud must be protected according to FedRAMP Moderate (or higher) requirements.
* The cloud provider must meetFedRAMP Moderate baseline security controls, which align withNIST SP
800-53moderate impact level requirements.
* The cloud provider must also ensure compliance withincident reportingandcyber incident response requirementsin DFARS 252.204-7012.
Key Requirements from DFARS 252.204-7012 (c)(1):
* A. FedRAMP Low # Incorrect
* FedRAMP Lowis intended for systems withlow confidentiality, integrity, and availability risks, making itinadequate for CUI protection.
* B. FedRAMP Moderate # Correct
* FedRAMP Moderate is the minimum required level for CUIunder DFARS 252.204-7012.
* It provides a security baseline for protectingsensitive but unclassified government data.
* C. FedRAMP High # Incorrect
* FedRAMP Highapplies to systems handlinghighly sensitive information (e.g., classified or national security data), which is not necessarily required for CUI.
* D. FedRAMP Secure # Incorrect
* There isno official FedRAMP Secure categoryin FedRAMP guidelines.
Why is the Correct Answer "FedRAMP Moderate" (B)?
* DFARS 252.204-7012(c)(1)
* Specifies thatcontractors using external cloud services for CUI must meet FedRAMP Moderate or equivalent.
* CMMC 2.0 Level 2 Requirements
* CUI must be protected using NIST SP 800-171 security requirements, whichalign with FedRAMP Moderate controls.
* FedRAMP Security Baselines
* FedRAMP Moderateis designed for systems that handlesensitive government data, including CUI.
CMMC 2.0 References Supporting this answer:
質問 # 30
Where does the requirement to include a required practice of ensuring that personnel are trained to carry out their assigned information security-related duties and responsibilities FIRST appear?
- A. Level 3
- B. All levels
- C. Level 1
- D. Level 2
正解：D
解説：
Understanding Training Requirements in CMMC
The requirement for ensuring thatpersonnel are trained to carry out their assigned information security-related duties and responsibilitiesfirst appears inCMMC Level 2as part ofNIST SP 800-171 control AT.L2-3.2.1.
Key Details on the Training Requirement:
#AT.L2-3.2.1: "Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities."
#This control is derived fromNIST SP 800-171and applies toCMMC Level 2 (Advanced).
#It ensures that employees handlingControlled Unclassified Information (CUI)understand theircybersecurity responsibilities.
Why is the Correct Answer "B. Level 2"?
A). Level 1 # Incorrect
CMMC Level 1 does not include this training requirement.Level 1 focuses on basic safeguarding ofFederal Contract Information (FCI)but doesnot require formal cybersecurity training.
B). Level 2 # Correct
The training requirement (AT.L2-3.2.1) first appears in CMMC Level 2, which aligns withNIST SP 800-171.
C). Level 3 # Incorrect
The training requirementalready exists in Level 2. Level 3 builds on Level 2 with additionalrisk management and advanced cybersecurity controls, but training is introduced at Level 2.
D). All levels # Incorrect
CMMC Level 1 does not include this requirement-it is first introduced in Level 2.
CMMC 2.0 References Supporting This Answer:
NIST SP 800-171 (Requirement 3.2.1)
Defines themandatory training requirementfor personnel handling CUI.
CMMC Assessment Guide for Level 2
ListsAT.L2-3.2.1as a required practice under Level 2.
CMMC 2.0 Model Overview
Confirms thatCMMC Level 2 aligns with NIST SP 800-171, which includes security training requirements.
質問 # 31
According to the Configuration Management (CM) domain, which principle is the basis for defining essential system capabilities?
- A. Essential concern
- B. Least functionality
- C. Least privilege
- D. Separation of duties
正解：B
質問 # 32
An Assessment Team Member is conducting a CMMC Level 2 Assessment for an OSC that is in the process of inspecting Assessment Objects for AC.L1-3.1.1: Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems) to determine the adequacy of evidence provided by the OSC. Which Assessment Method does this activity fall under?
- A. Examine
- B. Interview
- C. Test
- D. Observe
正解：A
解説：
Understanding Assessment Methods in CMMC 2.0According to theCMMC Assessment Process (CAP) Guide, assessors usethree primary assessment methodsto determine compliance with security practices:
Examine- Reviewing documents, policies, configurations, and system records.
Interview- Speaking with personnel to gather insights into security processes.
Test- Performing technical validation of system functions and security controls.
TheAssessment Team Memberis inspectingAssessment Objects(e.g., system configurations, user access control settings, policies) to determine if the OSC's evidence is sufficient forAC.L1-3.1.1 (Access Control - Authorized Users).
This activity aligns directly with theExaminemethod, which involves reviewing artifacts such as:
Access control lists (ACLs)
System user authentication logs
Account management policies
Role-based access control settings
"Observe" (Option B)is incorrect because "observing" is not an official assessment method in CMMC.
"Test" (Option A)is incorrect because the assessment is not actively executing a function but ratherreviewingevidence.
"Interview" (Option D)is incorrect because no personnel are being questioned-only documentation is being reviewed.
CMMC Assessment Process (CAP) Guide, Section 3.5 - Assessment Methods
CMMC Level 2 Assessment Guide - Access Control Practices (AC.L1-3.1.1)
Why Option C (Examine) is CorrectOfficial CMMC Documentation ReferencesFinal VerificationSince the activity involves reviewing documents and records to verify access control measures, it falls under theExaminemethod, makingOption C the correct answer.
質問 # 33
The Level 1 practice description in CMMC is Foundational. What is the Level 2 practice description?
- A. Optimizing
- B. Advanced
- C. Expert
- D. Continuously Improved
正解：B
質問 # 34
Which statement BEST describes an assessor's evidence gathering activities?
- A. Use interviews for assessing a Level 2 practice.
- B. Test all practices or objectives for a Level 2 practice
- C. Test certain assessment objectives to determine findings.
- D. Use examinations, interviews, and tests to gather sufficient evidence.
正解：D
解説：
Under theCMMC Assessment Process (CAP)andCMMC 2.0 guidelines, assessors must gather objective evidence to validate that an organization meets the required security practices and processes. This evidence collection is performed throughthree primary assessment methods:
* Examination- Reviewing documents, records, system configurations, and other artifacts.
* Interviews- Speaking with personnel to verify processes, responsibilities, and understanding of security controls.
* Testing- Observing system behavior, performing technical validation, and executing controls in real- time to verify effectiveness.
* TheCMMC Assessment Process (CAP)states that an assessor must use acombinationof evidence- gathering methods (examinations, interviews, and tests) to determine compliance.
* CMMC 2.0 Level 2(Aligned withNIST SP 800-171) requires assessors to verify not only that policies and procedures exist but also that they are implemented and effective.
* Solely relying ononemethod (like interviews in Option A) is insufficient.
* Testing all practices or objectives (Option B)is unnecessary, as assessors followscoping guidanceto determine which objectives need deeper examination.
* Testing only "certain" objectives (Option C)does not fully align with the requirement of gathering sufficient evidencefrom multiple methods.
* CMMC Assessment Process (CAP) Guide, Section 3.5 - Assessment Methodsexplicitly defines the use of examinations, interviews, and tests as the foundation of an effective assessment.
* CMMC 2.0 Level 2 Practices and NIST SP 800-171require assessors to validate the presence, implementation, and effectiveness of security controls.
* CMMC Appendix E: Assessment Proceduresstates that an assessor should use multiple sources of evidence to determine compliance.
Why Option D is CorrectCMMC 2.0 and Official Documentation ReferencesFinal VerificationTo ensure compliance withCMMC 2.0 guidelines and official documentation, an assessor must useexaminations, interviews, and teststo gather evidence effectively, makingOption D the correct answer.
質問 # 35
An assessment procedure consists of an assessment objective, potential assessment methods, and assessment objects. Which statement is part of an assessment objective?
- A. Specifications and mechanisms
- B. Exercising assessment objects under specified conditions
- C. Examination, interviews, and testing
- D. Determination statement related to the practice
正解：D
解説：
Understanding CMMC Assessment ProceduresACMMC assessment procedureconsists of:
* Assessment Objective- Defines what is being evaluated and the expected outcome.
* Assessment Methods- Specifies how the evaluation is conducted (e.g.,examination, interviews, testing).
* Assessment Objects- Identifies what is being evaluated, such as policies, systems, or people.
* Assessment Objectivesincludedetermination statementsthat describe the expected outcome for each CMMC security practice.
* These statements define whether a practice has beenadequately implementedbased ondocumented evidence and assessment findings.
* TheCMMC Assessment Process (CAP) GuideandNIST SP 800-171Aspecify that each practice has a determination statement guiding assessment decisions.
* A. Specifications and mechanisms#Incorrect
* These belong toassessment objects, which refer to the systems, policies, and mechanisms being evaluated.
* B. Examination, interviews, and testing#Incorrect
* These areassessment methods, which describe how assessorsverifycompliance (e.g., through interviews or testing).
* D. Exercising assessment objects under specified conditions#Incorrect
* This refers toassessment testing, which is a method, not an assessment objective.
* CMMC Assessment Process (CAP) Guide- Describes determination statements as the core of assessment objectives.
* NIST SP 800-171A- Defines determination statements as a key element of evaluating security controls.
Why the Correct Answer is "C"?Why Not the Other Options?Relevant CMMC 2.0 References:Final Justification:Since anassessment objectiveincludes adetermination statementthat describes whether a practice is implemented properly, the correct answer isC.
質問 # 36
Which government agency are DoD contractors required to report breaches of CUI to?
- A. Under Secretary of Defense for Intelligence and Security
- B. NARA
- C. FBI
- D. DoD Cyber Crime Center
正解：D
質問 # 37
The Assessment Team has completed the assessment and determined the preliminary practice ratings. The preliminary practice ratings must be shared with the OSC prior to being finalized for submission. Based on this information, the assessor should present the preliminary practice ratings:
- A. Via email after the final Daily Checkpoint
- B. During the final Daily Checkpoint
- C. Over the phone after the final Daily Checkpoint
- D. After discussing with the CMMC-AB
正解：B
解説：
According to the CMMC Assessment Process (CAP) v2.0, assessors are required to conduct Daily Checkpoint Meetings at the end of each day to summarize progress with the OSC (Organization Seeking Certification).
The final Daily Checkpoint is where preliminary practice ratings are shared, before the quality assurance review and Out-Brief. The Out-Brief is reserved for the presentation of final results. Additionally, Department of Defense regulations (32 CFR 170.17(c)(2)) provide a 10-business-day re-evaluation window for requirements marked NOT MET before the final report is delivered, which necessitates that the OSC see preliminary ratings during the assessment process itself.
Supporting Extracts from Official Content:
CAP v2.0, 2.23: "The assessment team shall host a Daily Checkpoint Meeting with the OSC at the end of each assessment day to summarize progress." CAP v2.0, 3.7: "The C3PAO shall conduct the quality assurance review... prior to the conduct of the Out- Brief Meeting." CAP v2.0, 3.10: "The purpose of the Out-Brief Meeting is to convey the results of the assessment to the OSC."
32 CFR 170.17(c)(2): "A security requirement assessed as NOT MET may be re-evaluated... for 10 business days... if the CMMC Assessment Findings Report has not been delivered." Why Option A is Correct:
The CAP specifies that Daily Checkpoint Meetings are the formal, structured mechanism for assessors to communicate progress and preliminary findings to the OSC.
The final Daily Checkpoint provides the OSC with visibility into the preliminary practice ratings before they are finalized, ensuring transparency and alignment.
The Out-Brief is explicitly for conveying the final assessment results after the C3PAO has completed QA.
Federal regulation (32 CFR 170.17(c)(2)) requires the OSC to have access to preliminary results so they can provide additional evidence for re-evaluation before the report is locked, further confirming that this exchange must occur at the final Daily Checkpoint.
References (Official CMMC v2.0 Content):
CMMC Assessment Process (CAP) v2.0: Sections 2.23 (Daily Checkpoints), 3.7-3.10 (QA and Out-Brief).
32 CFR 170.17(c)(2): Security Requirement Re-evaluation Window.
DoD CMMC Assessment Guide - Level 2 (v2.13): Guidance on MET/NOT MET determinations and findings.
質問 # 38
Which document specifies the CMMC Level 1 practices that correspond to basic safeguarding requirements?
- A. NIST SP 800-171
- B. NIST SP 800-171b
- C. DFARS 252.204-7012
- D. 48 CFR 52.204-21
正解：D
解説：
CMMC Level 1 practices correspond directly to the basic safeguarding requirements for Federal Contract Information (FCI), which are codified in FAR clause 48 CFR 52.204-21. These 15 requirements form the foundation for Level 1 compliance.
Supporting Extracts from Official Content:
48 CFR 52.204-21: "Contractors shall apply the following 15 basic safeguarding requirements to protect Federal Contract Information (FCI)." CMMC Model v2.0 Overview: "Level 1 corresponds to the 15 basic safeguarding requirements in FAR
52.204-21."
Why Option C is Correct:
FAR 52.204-21 is the source for Level 1 practices.
NIST SP 800-171 applies to CUI and Level 2, not Level 1.
NIST SP 800-171b is the precursor to NIST SP 800-172 (used for Level 3).
DFARS 252.204-7012 covers CUI safeguarding and incident reporting, not Level 1 FCI requirements.
References (Official CMMC v2.0 Content):
FAR 48 CFR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems.
CMMC Model v2.0, Level 1 Overview.
質問 # 39
......
100%更新されたのはCyber AB CMMC-CCP限定版PDF問題集：https://www.passtest.jp/Cyber-AB/CMMC-CCP-shiken.html
無料Cyber AB CMMC CMMC-CCP公式認定ガイドPDFダウンロード：https://drive.google.com/open?id=1wgLK3XzeF-aD6K0MjnuYH4tCbT1dZaVb