Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 101:

  You are on-site with an Assessment Team at a medium-sized organization. When discussing how they protect their company's information from malware, spyware, etc., the administrator you are interviewing offers to show you the entire process from start to finish since she had that on her to-do list for the day. She opens the machine, turns it on, and installs what she says is anti-malware software. She also demonstrates how their deployed Next Generation Firewall (NGFW) works. You have never heard of this software, so you ask her where it was purchased. You later learn it is an open-source solution. Based on the scenario and the requirements of CMMC practice SI.L2-3.14.6 ?Monitor Communications for Attacks, what is your likely determination?

  A. Find the OSC's implementation as partially Met as they are achieving several objectives required of this practice
  B. Fail the OSC's implementation of the practice
  C. Find the OSC's implementation of the practice as Met
  D. Request for more information
  D. Request for more information

• Question 102:

  An OSC submits to the C3PAO Assessment Team for validation a CMMC assessment scope that includes an enclave. During validation, you learn that while CUI is stored on a single physical server, authorized employees can access it through virtual instances, thanks to VMware. You also determine that the OSC has deployed a DFARS-compliant firewall to protect network connections to the enclave and a VLAN to restrict communication between different portions of the network. Which method can the OSC be said to have used to secure its enclave?

  A. Physical separation
  B. Segmentation
  C. Decentralization
  D. Virtualization
  B. Segmentation

• Question 103:

  You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery. How will proper separation of duties help the contractor meet the intent of AC.L2-3.1.4 ?Separation of Duties?

  A. It allows the engineers to specialize in specific areas
  B. It reduces concentrated privileges and power and improves checks and balances. Errors and malicious actions are more likely to be caught. Risk is reduced without relying solely on one individual
  C. It reduces the overall cost of software development
  D. It simplifies the development process
  B. It reduces concentrated privileges and power and improves checks and balances. Errors and malicious actions are more likely to be caught. Risk is reduced without relying solely on one individual

• Question 104:

  You are a Lead Assessor, and an OSC has engaged your C3PAO firm to conduct a CMMC assessment. As the Lead Assessor, you are responsible for identifying, documenting, and communicating any potential risks that could impact the successful completion of the planned assessment. You need to evaluate various risk categories and develop mitigation plans to ensure a smooth assessment process. If a member of the Assessment Team is at risk of being delayed and is unable to start the assessment on time, which of the following would be an appropriate mitigation plan?

  A. Proceed with the assessment without the delayed team member
  B. Request additional resources from the OSC to compensate for the delayed team member
  C. Reschedule the assessment for a later date
  D. Identify an alternate resource to shadow the Assessment Team member and potentially act as a successor
  D. Identify an alternate resource to shadow the Assessment Team member and potentially act as a successor

• Question 105:

  A CCA receives a notification from the Cyber AB that they are being investigated for a potential violation of the CoPC. They are concerned about the potential consequences and want to understand the process better. Who has the final authority to determine the corrective action taken against a CCA, if any?

  A. The investigator assigned to the CCA's case.
  B. The CMMC Accreditation Body (the Cyber AB).
  C. The C3PAO.
  D. The Lead Assessor.
  B. The CMMC Accreditation Body (the Cyber AB).

• Question 106:

  In ensuring it meets its mandates to protect CUI under CMMC, a contractor has implemented a robust, dynamic session lock with pattern-hiding displays to prevent access and viewing of data. After every 5 minutes of inactivity, the current session is locked and a blank, black screen with a battery life indicator is displayed. How is Session Lock typically initiated?

  A. Automatically, after a predefined period of inactivity
  B. By the system administrator manually
  C. Through user authentication processes
  D. Only when manually triggered by the user before leaving their workstation
  A. Automatically, after a predefined period of inactivity

• Question 107:

  Certified CMMC Assessors must follow assessment procedures when conducting CMMC assessments. These procedures include a series of steps and tools that the CCA will use in the course of their duties. Which of the following is not part of an assessment procedure?

  A. Assessment Method
  B. Assessment Objects
  C. Assessment procedure depth and coverage
  D. Assessment Objective
  C. Assessment procedure depth and coverage

• Question 108:

  A C3PAO Assessment Team is conducting a CMMC Level 2 assessment. During the assessment, the OSC provides evidence that a practice is partially implemented, with plans to complete it within a month. The practice is not eligible for the Limited Practice Deficiency Correction Program. How should the Lead Assessor score this practice?

  A. Score it as "MET" since the OSC has a plan to complete it soon.
  B. Score it as "NOT MET" since it is not fully implemented and is ineligible for deficiency correction.
  C. Score it as "PARTIALLY MET" and include it in a POAandM.
  D. Defer scoring until the OSC completes the implementation.
  B. Score it as "NOT MET" since it is not fully implemented and is ineligible for deficiency correction.

• Question 109:

  As a CCA, you were the Lead Assessor for a C3PAO Assessment Team that has just completed a CMMC assessment for an OSC. However, an individual has requested under the FOIA that your C3PAO release the assessment results. As the Lead Assessor, your C3PAO wants to hear your views on this request. What should your recommendation be?

  A. Release a redacted version of the assessment results.
  B. Refer the FOIA request to the CMMC Accreditation Body for guidance and a decision on whether to release the assessment results.
  C. Release the full assessment results.
  D. Deny the request and do not release any assessment information.
  D. Deny the request and do not release any assessment information.

• Question 110:

  After the OSC and the Assessment Team scheduled the initial meeting, they agreed that the initial discussions would be held in the OSC's facilities. Walking into the conference room, the Lead Assessor notices multiple laptops and printers tagged "U.S. Government Owned." How should the OSC have categorized these assets in their proposed assessment scope?

  A. Government Property
  B. Government Furnished Equipment (GFE)
  C. Specialized Assets
  D. CUI Assets
  C. Specialized Assets