Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 1:

  The OSC's network consists of a single unmanaged switch that connects all devices, including OT equipment which cannot run a vendor-supported operating system. The OSC correctly scoped the OT equipment as a Specialized Asset, listed it in their inventory and SSP, and provided a network diagram showing plans to isolate the OT and apply additional security measures.

  What information does the Lead Assessor still require to ensure compliance?

  A. Installation and configuration documentation for the OT to ensure it was correctly built
  B. Wording in the scoping document detailing how the OT adheres to all other applicable CMMC practices
  C. Wording in the SSP detailing how the OT is managed using the OSC's risk-based security policies, procedures, and practices
  D. Evidence that the network isolation is completed by the end of the assessment as well as supporting evidence for all other applicable CMMC practices
  D. Evidence that the network isolation is completed by the end of the assessment as well as supporting evidence for all other applicable CMMC practices

  ---

  Explanation

  Applicable Requirement (CMMC Scoping Guidance - Specialized Assets): Specialized Assets (e. g., OT, IoT, GFE, test equipment) are not exempt from CMMC practices. OSCs must provide:

  Documented identification in SSP/inventory, Justification of specialized handling, Evidence that risk-based security measures are implemented.

  Why Option D is Correct: Assessors must see evidence that isolation is actually implemented (not just planned), plus supporting artifacts showing how remaining applicable practices are addressed (monitoring, inventory, access, etc.).

  Planned measures alone are insufficient.

  Why Other Options Are Insufficient:

  Option A: Installation/config builds do not show operational isolation.

  Option B: Scoping statements alone do not demonstrate implementation.

  Option C: SSP language is descriptive but must be supported by implementation evidence.

  References (CCA Official Sources):

  CMMC Scoping Guidance - Specialized Assets CMMC Assessment Guide - Level 2 - Evidence Requirements for Specialized Assets NIST SP 800-171 Rev. 2 - Asset Management and Risk-Based Controls

• Question 2:

  While assessing an OSC, you realize they have given identifiers to systems, users, and processes.

  Examining their documentation, you know they have assigned accounts uniquely to employees, contractors, and subcontractors. The OSC has an automated system that disables any identifiers that are left unused for 6 months. You also learn from interviewing IT security administrators that the OSC has defined a technical and documented policy where identifiers can only be reused after 12 months.

  How would you score the contractor's implementation of CMMC practice IA.L2-3.5.5 - Identifier Reuse?

  A. Not Met (-5 points)
  B. Met (+1 point)
  C. Met (+2 points)
  D. Met (+5 points)
  B. Met (+1 point)

• Question 3:

  An OSC uses a web application for document management. Employees can access this application from any internet-connected device through a web browser. The application resides on servers in a secure data center managed by a third-party vendor. The OSC maintains separate servers within its network to store the documents.

  When employees use the web application to upload documents, what type of locations are they interacting with?

  A. A logical location for the web application and a physical location for the document storage servers
  B. A secure area within the OSC's data center
  C. The physical location of their internet-connected devices
  D. The physical location of the vendor's data center
  A. A logical location for the web application and a physical location for the document storage servers

• Question 4:

  You were the Lead Assessor on a team that conducted a CMMC assessment for an OSC that passed and earned a CMMC L2 Certification. Meeting this requirement, the OSC bid on and won a DoD contract.

  However, a rival company disputes the OSC's CMMC certification status in court. As part of the evidence, the court has directed you to release the assessment results and any evidence you might have relied on to arrive at the assessment results.

  Based on the CoPC, what action should you take in this situation?

  A. Release the assessment results only after obtaining written permission from the OSC being assessed.
  B. Release the assessment results.
  C. Do not release the assessment results under any circumstances.
  D. Release only a summary of the assessment results.
  B. Release the assessment results.

• Question 5:

  You are a CCA with an active and good standing on the Cyber AB Marketplace. An OSC has contracted your C3PAO for a prospective CMMC Assessment. The OSC provides signal processing services for the DoD. You assisted the OSC in preparing for the upcoming CMMC assessment by conducting an initial evaluation of their implementation practices. With your background in cybersecurity and extensive experience, your C3PAO and Lead Assessor have selected you to join the Assessment Team.

  Based on this scenario, which of the following is the most important factor for the C3PAO to consider when assigning assessors to the Assessment Team?

  A. The Assessor's active status and good standing as a CMMC Certified Assessor or Professional, verified on the Cyber AB Marketplace, are important factors.
  B. The Assessor's hourly rate, especially for independent assessors.
  C. The Assessor's professional reputation within the CMMC ecosystem.
  D. The Assessor's specialization with the OSC's lines of business or industry sub-sector.
  A. The Assessor's active status and good standing as a CMMC Certified Assessor or Professional, verified on the Cyber AB Marketplace, are important factors.

• Question 6:

  You are a CCA working for a C3PAO that has entered into a contractual agreement to provide CMMC assessment services for an OSC. After validating the evidence, the C3PAO feels that the task is beyond its capabilities and informs the OSC that it cannot continue with the assessment. The C3PAO cites "insufficient workforce" as the reason.

  What principle of the CMMC CoPC has the C3PAO broken?

  A. Adherence to Materials and Methods
  B. Information Integrity
  C. Professionalism
  D. Respect for Intellectual Property
  C. Professionalism

• Question 7:

  You are assessing a contractor's implementation for CMMC practice MA.L2-3.7.4 - MediaInspection by examining their maintenance records. You realize the maintenance logs identify a repeating problem. A recently installed central server has been experiencing issues affecting the performance of the contractor's information systems. This is confirmed by your interview with the contractor's IT team. You requested to investigate the server, and the IT team agreed. On the server, there is a file named conf.zip that gets your attention. You decide to open the file in an isolated computer for further review.

  To your surprise, the file is a .exe used when testing the server for data exfiltration.

  How should this incident be handled?

  A. By immediately reporting it to the FBI's Cyber Division
  B. Decommissioning the server and installing a new one
  C. In accordance with the incident response plan
  D. By sandboxing the malicious code and continuing with business as usual
  C. In accordance with the incident response plan

• Question 8:

  An Assessment Team is holding a discussion with the system administrator at the OSC to understand their process for ensuring unauthorized users are not able to access CUI.

  Which assessment method is being utilized?

  A. Test method
  B. Observe method
  C. Examine method
  D. Interview method
  D. Interview method

  ---

  Explanation

  The CMMC Assessment Process (CAP) defines four methods: Examine, Interview, Test, and Observe.

  Interview Method: Involves discussions with personnel to gather evidence about the implementation of practices.

  In this case, the CCA is discussing with the system administrator to understand processes, which clearly aligns with the Interview method.

  Extract:

  "Interview: The assessor uses discussions with personnel to obtain evidence about how practices are implemented within the OSC's environment."

  References:

  CMMC Assessment Guide - Level 2

  CMMC Assessment Process (CAP).

• Question 9:

  While examining a contractor's audit and accountability policy, you realize they have documented types of events to be logged and defined content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activities. After the logs are analyzed, the results are fed into a system that automatically generates audit records stored for 30 days. However, mechanisms implementing system audit logging are lacking after several tests because they produce audit logs that are too limited. You find that generated logs cannot be independently used to identify the event they resulted from because the defined content specified therein is too limited. Additionally, you realize the logs are retained for 24 hours before they are automatically deleted.

  All of the following are required to satisfy AU.L2-3.3.1 - System Auditing assessment objectives [b] and [d], EXCEPT?

  A. Process identifiers
  B. Failure or success indications
  C. Timestamps
  D. File permissions
  D. File permissions

• Question 10:

  The Lead Assessor is planning to conduct an assessment for an OSC. The Assessor has been given a preliminary asset inventory list by the OSC.

  How would the Lead Assessor determine if any assets are out-of-scope for the assessment?

  A. All assets in an OSC's inventory fall within the scope of the assessment and, as such, should be assessed against the CMMC practices.
  B. None of the assets in an OSC's inventory fall within the scope of the assessment and, as such, should not be assessed against the CMMC practices.
  C. Assets cannot process, store, or transmit CUI because they are physically or logically separated from CUI assets, or they are inherently unable to do so.
  D. Out-of-Scope Assets can process, store, or transmit CUI because they do not need to be physically or logically separated.
  C. Assets cannot process, store, or transmit CUI because they are physically or logically separated from CUI assets, or they are inherently unable to do so.

  ---

  Explanation

  According to the CMMC Scoping Guidance, assets are categorized based on whether they can process, store, or transmit Controlled Unclassified Information (CUI), or if they are physically/logically separated or inherently unable to interact with CUI systems. Assets that cannot process, store, or transmit CUI and are properly segregated are considered Out-of-Scope.

  Extract from CMMC Scoping Guidance:

  "Out-of-Scope assets are those that cannot process, store, or transmit CUI because they are physically or logically separated from CUI assets, or they are inherently unable to do so."

  Thus, the Lead Assessor determines out-of-scope assets by confirming that they are either segregated from CUI systems or technically incapable of handling CUI.

  References:

  CMMC 2.0 Scoping Guidance for Level 2 Assessments (Official CCA documentation).