Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 91:

  When validating an OSC's assessment scope, an Assessment Team learns that the proposed scope is too narrow and their asset categorization is mixed up.

  What should the Assessment Team do?

  A. Review the OSC's environment and asset categorization to determine the proper scoping for the organization.
  B. Stop the assessment.
  C. Advise the OSC to conduct another scoping exercise that covers all assets.
  D. Require the OSC to refine its security boundaries to include all assets that come into contact with CUI.
  A. Review the OSC's environment and asset categorization to determine the proper scoping for the organization.

• Question 92:

  An OSC previously received a Conditional CMMC Level 2 Certification during Phase 3 of the assessment process. The OSC has been working on implementing a POA&M to address the practice deficiencies identified during the initial assessment. Now, within 180 days from the Final Recommended Findings Briefing, you are to conduct a POA&M Closeout Assessment. As the Lead Assessor, you and your assessment team review the OSC's updated POA&M, accompanying evidence, and any scheduled observations, interviews, or tests with the aim of validating the implementation of the corrective actions.

  If the Organization Seeking Certification (OSC) disagrees with the C3PAO's findings during the POA&M Closeout Assessment, what is the recourse?

  A. Immediately reapply for CMMC Level 2 certification with a different C3PAO.
  B. Submit an appeal using the Assessment Appeals Process outlined in the CAP.
  C. Request an extension of the timeline for corrective actions.
  D. Demand a reassessment by the same C3PAO and Lead Assessor.
  B. Submit an appeal using the Assessment Appeals Process outlined in the CAP.

• Question 93:

  A cloud-native OSC uses a vendor's FedRAMP MODERATE authorized cloud environment for all aspects of their CUI needs (identity, email, file storage, office suite, etc.) as well as the vendor's locally installable applications. The OSC properly configured the vendor's cloud-based SIEM system to monitor all aspects of the cloud environment. The OSC's SSP documents SI.L2-3.14.7: Identify Unauthorized Use, defining authorized use and referencing procedures for identifying unauthorized use.

  How should the Certified Assessor score this practice?

  A. NOT MET because logs from physical infrastructure are not captured by the SIEM.
  B. NOT MET because locally installable applications from a cloud-native environment are not allowed.
  C. MET because being cloud-native is a great way to contain risk to a vendor's environment.
  D. MET because the cloud SIEM is configured to monitor all of the vendor's cloud environment.
  D. MET because the cloud SIEM is configured to monitor all of the vendor's cloud environment.

  ---

  Explanation

  SI.L2-3.14.7 requires the OSC to identify unauthorized use of organizational systems. The OSC meets this requirement by configuring the FedRAMP MODERATE provider's SIEM to monitor their entire cloud environment where CUI is processed.

  Extract:

  "Organizations must employ monitoring mechanisms to detect unauthorized use of information systems.

  Cloud-native environments with FedRAMP authorized monitoring meet the requirement when properly configured and documented."

  Thus, the practice is MET because the SIEM covers the cloud environment.

  References:

  CMMC Assessment Guide - Level 2, SI.L2-3.14.7.

• Question 94:

  An OSC has produced two assessment scopes. When the Lead Assessor questioned the OSC PoC why, they detailed that they process, store, or transmit FCI within one assessment scope and CUI in another.

  Which scope will the OSC obtain a CMMC Level 2 certification for?

  A. The scope that processes, transmits, or stores FCI
  B. The scope that transmits, processes, or stores CUI
  C. For both assessment scopes
  D. The OSC cannot be certified at Level 2 because they haven't met Level 1 requirements
  B. The scope that transmits, processes, or stores CUI

• Question 95:

  An OSC outsources all of its security incident and event monitoring work to a third-party SOC. Additionally, the OSC utilizes a cloud-hosted antivirus (AV) system to fulfill the requirement of having virus protection without hosting additional servers on-site.

  During the scoping discussion, both the SOC and AV should be listed as what type of asset?

  A. They are CUI Assets due to their operation within a CUI network.
  B. They are Out-of-Scope Assets due to being fully hosted/operated by third parties.
  C. They are Security Protection Assets due to their performance of security functions.
  D. They are Contractor Risk Managed Assets because they are not physically or logically isolated from CUI assets.
  C. They are Security Protection Assets due to their performance of security functions.

  ---

  Explanation

  The Scoping Guidance defines Security Protection Assets as systems, tools, or services that provide security functions protecting CUI assets, even if outsourced to third parties.

  Extract:

  "Security Protection Assets are tools, systems, or services that provide security functionality (e.g., SOC, antivirus, logging) to protect CUI assets. These must be included in scope." Therefore, SOC and AV must be categorized as Security Protection Assets.

  References:

  CMMC Scoping Guidance - Security Protection Assets.

• Question 96:

  An OSC has provided its System Security Plan (SSP) as evidence for several CMMC practices related to system security. During your examination of the SSP, you discover a section outlining procedures for user access controls. However, upon further review, you find no mention of procedures for managing privileged accounts, which is a critical aspect of secure system access.

  According to the guidelines for examining evidence, what is the most appropriate course of action for the Lead Assessor in this scenario?

  A. Accept the SSP as sufficient evidence and move on to the next practice.
  B. Explain the discrepancy to the OSC but allow them to keep the existing SSP as evidence.
  C. Recommend that the CMMC practice related to user access controls be marked "Not Met" due to the missing procedures.
  D. Request additional evidence from the OSC that specifically addresses privileged account management.
  D. Request additional evidence from the OSC that specifically addresses privileged account management.

• Question 97:

  During a POA&M Close-Out Assessment, the Lead Assessor encounters a situation where the organization's corrective actions for a specific practice have inadvertently limited the effectiveness of another practice that was previously scored as `MET' during the initial assessment.

  In this scenario, what should the Lead Assessor's recommendation to their C3PAO be?

  A. Update the POA&M and recommend the organization for CMMC Level 2 Final Certification, adding the affected practice to the POA&M.
  B. Defer the recommendation and request the organization to undergo a full reassessment.
  C. Recommend the organization for CMMC Level 2 Final Certification.
  D. Recommend the organization not be granted CMMC Level 2 Final Certification.
  D. Recommend the organization not be granted CMMC Level 2 Final Certification.

• Question 98:

  You are the Lead Assessor for a CMMC Level 2 assessment. The OSC has implemented a practice using a manual process instead of an automated tool, as described in their SSP. The manual process meets the practice's objectives.

  How should you evaluate this evidence?

  A. Score the practice as "MET" since the manual process meets the objectives.
  B. Document the deviation from the SSP as an evidence gap and assess based on the manual process's effectiveness.
  C. Score the practice as "NOT MET" due to the deviation from the SSP.
  D. Request the OSC to implement the automated tool as described in the SSP.
  B. Document the deviation from the SSP as an evidence gap and assess based on the manual process's effectiveness.

• Question 99:

  Change is a part of any production process and must be meticulously managed. System Change Management is a CMMC requirement, and you have been called in to assess the implementation of CMMC requirements. When examining the contractor's change management policy, you realize there is a defined change advisory board that has a review and approval mandate for any proposed changes. The change advisory board maintains a change request system where all the changes are submitted and documented for easy tracking and review. The contractor also has a defined rollback plan defining what to do in case the approved changes result in unexpected issues or vulnerabilities.

  What evidence artifacts can the contractor also cite as evidence to show their compliance with CM.L2- 3.4.3 - System Change Management besides their change management policy?

  A. Employee satisfaction surveys regarding the change management process
  B. System uptime statistics showing improved stability after change management implementation
  C. Organizational procedures addressing system configuration change control and change control/audit review reports
  D. Antivirus scan reports detailing detected and quarantined threats
  C. Organizational procedures addressing system configuration change control and change control/audit review reports

• Question 100:

  An in-house compliance expert for a large defense contractor is reviewing the organization's training materials for personnel handling CUI. After a widely publicized insider threat incident, management requires that training address insider threat risks.

  What is a critical component of insider threat awareness training?

  A. A bounty system for identifying and stopping insider threats
  B. A company-wide ranking of individuals by insider threat risk
  C. Law enforcement case studies on known insider threat activities
  D. Processes and procedures for reporting suspected insider threat activity
  D. Processes and procedures for reporting suspected insider threat activity

  ---

  Explanation

  Under AT.L2-3.2.3 (Security Awareness Training) and AT.L2-3.2.2 (Insider Threat Training), insider threat awareness training must equip personnel to recognize and report indicators of insider threat activity.

  Training must focus on organizational processes for reporting suspicious behavior, not just awareness of famous cases or punitive systems. The ability to act and report appropriately is the most critical element.

  Without reporting procedures, insider threat training is incomplete.

  Why other options are incorrect:

  Option A: Bounty systems are not sanctioned practices and could create a hostile work environment.

  Option B: Risk-ranking individuals could be discriminatory and is not a CMMC requirement.

  Option C: Case studies may supplement training but are not sufficient by themselves.

  References:

  CMMC Assessment Guide - Level 2, AT.L2-3.2.2 and AT.L2-3.2.3.

  NIST SP 800-171 Rev. 2, 3.2.2 (Insider Threat Training).