Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 101:

  While reviewing a contractor's Microsoft Active Directory authentication policies, you observe that the account lockout threshold is configured to allow 5 consecutive invalid login attempts before locking the account for 15 minutes. Additionally, the reset account lockout counter is set to 30 seconds after each unsuccessful login attempt.

  Based on this scenario, which of the following statements are TRUE about the contractor's implementation of CMMC practice AC.L2-3.1.8 - Unsuccessful Logon Attempts?

  A. The contractor has successfully implemented practice AC.L2-3.1.8 - Unsuccessful Logon Attempts warranting a score of MET
  B. The contractor's approach does not provide sufficient protection against unauthorized access attempts
  C. Based on the current implementation, CMMC practice AC.L2-3.1.8 cannot be scored as MET
  D. The contractor's approach does not adequately address the required assessment objectives
  A. The contractor has successfully implemented practice AC.L2-3.1.8 - Unsuccessful Logon Attempts warranting a score of MET

• Question 102:

  An OSC seeking Level 2 certification has a fully cloud-based environment. The assessor must evaluate fulfillment of Level 2 requirements the OSC implements versus those handled by the cloud service provider.

  Which document would be BEST to identify the Level 2 requirements handled by the OSC's cloud provider?

  A. Zero Trust Architecture
  B. Shared Responsibility Matrix
  C. Cloud Security Baseline White Paper
  D. Identity and Access Management (IAM) Plan
  B. Shared Responsibility Matrix

  ---

  Explanation

  The Shared Responsibility Matrix (Customer Responsibility Matrix) is the authoritative document that specifies which security responsibilities are owned by the OSC versus the Cloud Service Provider (CSP).

  This enables assessors to determine which CMMC practices apply to the OSC and which are inherited from the provider.

  Exact extracts:

  "External Service Providers (ESPs), including CSPs, must provide a Shared Responsibility Matrix that delineates customer versus provider responsibilities." "Assessors should request and review this matrix to determine practice applicability."

  Why other options are incorrect:

  Option A: Zero Trust Architecture is a design framework, not a responsibility breakdown.

  Option C: White papers are marketing/technical resources, not binding assignments of responsibility.

  Option D: IAM Plans address access management, not overall shared responsibilities.

  References:

  CMMC Scoping Guide - External Service Providers.

  CMMC Assessment Guide - Level 2, Use of Shared Responsibility Matrices.

• Question 103:

  An assessor reviews the OSC's data protection policy, which requires full disk encryption on company laptops. While interviewing employees, the assessor learns that employees sometimes access data while teleworking on laptops that do not have full disk encryption.

  How should the assessor view the implementation of the OSC's policy?

  A. Acceptable because it requires full disk encryption of company laptops.
  B. Insufficient because there are teleworking instances where the policy is not followed.
  C. Acceptable as long as an equivalent technical safeguard is implemented for all teleworking scenarios.
  D. Insufficient because full disk encryption is not required for laptops to comply with CMMC requirements.
  B. Insufficient because there are teleworking instances where the policy is not followed.

  ---

  Explanation

  The Assessment Guide emphasizes that a policy is insufficient unless it is implemented consistently across all applicable assets. Evidence from interviews showing exceptions means the practice is NOT

  MET.

  Extract:

  "Policies must not only exist but must also be enforced and implemented consistently. Exceptions indicate non-compliance." Thus, the correct answer is.B

  References:

  CMMC Assessment Guide - Level 2 Assessment Methodology.

• Question 104:

  During your review of an OSC's system security control, you focus on CMMC practice SC.L2-3.13.9 - Connections Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network. The server operating system utilizes default settings for connection timeouts. Network security is managed through a central firewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, there is no documented policy or procedure outlining a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work.

  Based on the scenario, what is the MOST concerning aspect from a CMMC compliance perspective regarding CMMC practice SC.L2-3.13.9 - Connections Termination?

  A. The application is hosted on a dedicated server within the company's internal network
  B. Users log in with usernames and passwords, potentially lacking multi-factor authentication
  C. The lack of a documented policy or a defined period of inactivity for terminating remote access connections creates uncertainty and inconsistency
  D. The server operating system utilizes default settings for connection timeouts, which may be insufficient
  C. The lack of a documented policy or a defined period of inactivity for terminating remote access connections creates uncertainty and inconsistency

• Question 105:

  You are the Lead Assessor for a CMMC Level 2 assessment. During the assessment, the OSC admits that a practice was implemented only a week before the assessment began due to a last-minute effort to prepare. The practice appears to meet the objectives based on the evidence provided.

  How should you evaluate this evidence?

  A. Accept the evidence and score the practice as "MET" since it meets the objectives at the time of assessment.
  B. Document the recent implementation as an evidence gap and assess based on its effectiveness and sustainability.
  C. Score the practice as "NOT MET" because it was not implemented prior to the assessment preparation.
  D. Request the OSC to provide evidence of longer-term implementation before proceeding.
  A. Accept the evidence and score the practice as "MET" since it meets the objectives at the time of assessment.

• Question 106:

  After the OSC and the Assessment Team scheduled the initial meeting, they agreed that the initial discussions would be held in the OSC's facilities. Walking into the conference room, the Lead Assessor notices multiple laptops and printers tagged "U.S. Government Owned."

  How should the OSC have categorized these assets in their proposed assessment scope?

  A. Government Property
  B. Government Furnished Equipment (GFE)
  C. Specialized Assets
  D. CUI Assets
  C. Specialized Assets

• Question 107:

  You are the Lead Assessor for a CMMC assessment. During the Final Findings Briefing, the OSC Assessment Official disputes a "NOT MET" finding, claiming the evidence was misinterpreted.

  What is the OSC's recourse according to the CMMC Assessment Process?

  A. Request an immediate reassessment by the same Assessment Team.
  B. Submit an appeal using the Assessment Appeals Process outlined in the CAP.
  C. Demand that the Lead Assessor revise the finding based on their explanation.
  D. Reapply for a new assessment with a different C3PAO.
  B. Submit an appeal using the Assessment Appeals Process outlined in the CAP.

• Question 108:

  While examining evidence, a CCA is trying to confirm the claim that the OSC has identified all information system users, processes acting on behalf of users, and all devices.

  Which of the following provides the STRONGEST evidence of this practice?

  A. Lists of system accounts and devices and system audit logs and records
  B. System design documentation and other relevant documents or records
  C. Procedures addressing user and system identification and authentication and SSP
  D. Identification and authentication policy and system configuration settings and associated documentation
  A. Lists of system accounts and devices and system audit logs and records

  ---

  Explanation

  For IA.L2-3.5.1 (Identify system users, processes, and devices), the strongest evidence is direct lists of accounts, devices, and supporting audit logs/records that show users and devices are actively identified and managed. Policies and procedures are supporting evidence but not as strong as system-generated, real evidence.

  Extract:

  "Strong evidence includes account listings, device inventories, and audit logs demonstrating that all users, processes, and devices are identified and uniquely associated."

  References:

  CMMC Assessment Guide - Level 2, IA.L2-3.5.1.

• Question 109:

  In assessing an OSC's CUI handling practices, you learn they use an approved algorithm (AES-256) to encrypt the data to ensure its confidentiality. However, the encryption module they are using has not been validated under the FIPS 140 standard. The OSC believes that using an approved algorithm is sufficient to comply with the CMMC practice for CUI encryption requirements.

  Which of the following would be the most appropriate next step for the assessor?

  A. Interview personnel responsible for cryptographic protection to determine if FIPS-validated cryptography is used elsewhere in the organization
  B. Test the encryption mechanism by attempting to decrypt the encrypted data without the proper keys
  C. Recommend that the OSC switch to a different, approved algorithm
  D. Accept the OSC's implementation as compliant, given that they are using a strong encryption algorithm
  A. Interview personnel responsible for cryptographic protection to determine if FIPS-validated cryptography is used elsewhere in the organization

• Question 110:

  A CMMC assessment for an OSC finds that it has fully implemented 87 out of 110 practices. Unfortunately, the Assessment Team determines that the POA&M Close-Out Assessment option cannot be used.

  Consequently, the OSC will not be recommended for certification. However, the OSC Assessment Official respectfully requests that the Lead Assessor adjust the findings to allow for POA&M close-out and mark a 5-point practice as implemented.

  How should the Lead Assessor respond?

  A. Politely decline the request and cite ethical reasons of violating the CoPC.
  B. Negotiate with the OSC to implement additional practices and reassess the POA&M Closeout Assessment option.
  C. Report the request to the Cyber AB and recommend disciplinary action against the OSC Assessment Official.
  D. Agree to the request and tweak the findings.
  A. Politely decline the request and cite ethical reasons of violating the CoPC.