Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 111:

  An OSC has a hardware and software list used to manage company assets.

  Which is the BEST evidence to show the OSC is managing the system baseline?

  A. Media protection
  B. Physical protection
  C. Configuration management
  D. Identification and authentication policy
  C. Configuration management

  ---

  Explanation

  System baselines are part of Configuration Management (CM). Maintaining an inventory of hardware and software is important, but the evidence of managing baselines lies in the configuration management process, which establishes and documents standard system configurations, approved software, and change control. The CMMC practice CM.L2-3.4.1 requires the OSC to establish and maintain baseline configurations.

  Exact extracts:

  "Baseline configurations are documented, formally reviewed, and maintained as part of configuration management." "Assessment Objectives... Determine if: baseline configurations are established; baseline configurations are maintained.""Potential Assessment Methods -

  Examine: configuration management policy; documented baseline configuration; inventory of system components."

  Why the other options are incorrect:

  Option A (Media protection): Relates to storage devices and handling, not baselines.

  Option B (Physical protection): Relates to facility and hardware security, not configuration.

  Option D (Identification and authentication policy): Addresses user access, not baseline configuration.

  References:

  CMMC Assessment Guide - Level 2, CM.L2-3.4.1 "Establish and Maintain Baseline Configurations." NIST SP 800-171 Rev. 2, 3.4.1.

• Question 112:

  A company mirrors its FCI/CUI data storage in a cloud environment. Data is managed across multiple virtual machines (VMs).

  To satisfy requirements for data security of the LOCAL copy using physical controls, what should the OSC do?

  A. Use encrypted transport and storage of FCI/CUI data on the VMs.
  B. Store FCI/CUI data without encryption for faster access/backup/restore.
  C. Ensure that the VMs are running on hardware that is physically located in a controlled-access facility.
  D. In addition to a password or personal identification number, use physical means to log in such as a smart card or hard token.
  C. Ensure that the VMs are running on hardware that is physically located in a controlled-access facility.

  ---

  Explanation

  The Physical Protection (PE) requirements require that systems containing FCI or CUI be placed in controlled-access facilities with safeguards against unauthorized physical access.

  Extract from PE.L2-3.10.1: "Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals."

  Thus, ensuring that the VMs run on hardware located in a controlled-access facility is the correct method to meet physical security requirements.

  References:

  CMMC Assessment Guide - Level 2, PE.L2-3.10.1.

• Question 113:

  During a CMMC assessment, the CCAs, CCPs, and Lead Assessor validate the assessment scope provided by the OSC. They must review documents and records specific to the agreed-upon scope and boundaries of the assessment. There are several documents the Assessment Team may review or analyze; some are required, and others not.

  Which of the following documents is NOT required when scoping a CMMC Assessment for Level 2 maturity?

  A. Network diagrams
  B. System Security Plan (SSP)
  C. Preliminary List of Evidence
  D. System Design documentation
  D. System Design documentation

• Question 114:

  A contractor has retained you to assess compliance with CMMC practices as part of their triennial review.

  During your assessment of the AU domain, you discovered that the contractor has recently installed new nodes and servers on their network infrastructure. To assess their implementation of AU.L2-3.3.7 - Authoritative Time Source, you trigger some events documented to meet AU.L2-3.3.1 - System Auditing across both the new and existing systems, generating audit logs. Upon examining these logs, you notice inconsistencies in the timestamps between newly installed and previously existing nodes. Further investigation reveals that while the contractor has implemented a central Network Time Protocol (NTP) server as the authoritative time source, the new systems are configured to automatically adjust and

  synchronize their clocks only when the time difference with the NTP server exceeds 30 seconds.

  Based on this scenario, how many points would you score theOSC's implementation of CMMC practice AU.L2-3.3.7 - Authoritative Time Source?

  A. 5
  B. -1
  C. 1
  D. -5
  B. -1

• Question 115:

  When conducting a CMMC assessment, the CCA must follow the steps outlined in the CMMC Assessment Process (CAP). This document is organized into several phases, each requiring the CCA to complete specific documents. The CAP also provides templates, some of which the Assessor must use and complete during specific phases.

  A CCA must complete all the following documents in Phase 1 of the CAP, EXCEPT?

  A. CMMC Assessment Quality Review Checklist.
  B. CMMC Assessment Readiness Review (CA-RR) Checklist.
  C. Virtual Assessment Evidence Preparation Template.
  D. CMMC Pre-Assessment Form Data Template.
  A. CMMC Assessment Quality Review Checklist.

• Question 116:

  John has just passed the CCA examination and is looking to gain real-world knowledge. You are a CCA working for a leading C3PAO and a friend of John's, and he hears that you are conducting a CMMC assessment and wants to learn about how some documents are completed. He asks if you could provide a CA-RR document you completed during your current engagement to help him understand how various fields are filled out.

  Which of the following is the most appropriate course of action?

  A. Redact any confidential information from the CA-RR document before sharing it with John.
  B. Decline to share any assessment documents with John.
  C. Provide John with blank CA-RR templates instead of completed documents.
  D. Share the completed CA-RR document with John.
  B. Decline to share any assessment documents with John.

• Question 117:

  As a CCA, you were the Lead Assessor for a C3PAO Assessment Team that has just completed a CMMC assessment for an OSC. However, an individual has requested under the FOIA that your C3PAO release the assessment results. As the Lead Assessor, your C3PAO wants to hear your views on this request.

  What should your recommendation be?

  A. Release a redacted version of the assessment results.
  B. Refer the FOIA request to the CMMC Accreditation Body for guidance and a decision on whether to release the assessment results.
  C. Release the full assessment results.
  D. Deny the request and do not release any assessment information.
  D. Deny the request and do not release any assessment information.

• Question 118:

  While reviewing CA.L2-3.12.3: Security Control Monitoring, the CCA notices that the assessment period is defined as one year. An OSC's SSP states that under CA.L2-3.12.3, security controls are monitored using the same one-year periodicity to ensure the continued effectiveness of the controls. The assessor understands that some CMMC practices can reference other practices for the entirety of their implementation.

  Is the OSC's implementation under CA.L2-3.12.3: Security Control Monitoring acceptable?

  A. No, even when referencing other practices more description is always needed.
  B. No, monitoring must be conducted on an ongoing basis to ensure continued effectiveness.
  C. Yes, a one-year period for security control monitoring is acceptable.
  D. Yes, as long as CA.L2-3.12.1 has been scored as MET, they do need to be monitored.
  B. No, monitoring must be conducted on an ongoing basis to ensure continued effectiveness.

  ---

  Explanation

  The requirement for CA.L2-3.12.3 - Security Control Monitoring mandates monitoring to be performed on an ongoing basis to ensure the continued effectiveness of the controls. This is not satisfied by a yearly review alone.

  CA.L2-3.12.3 Security Control Monitoring - Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

  The OSC's statement in their SSP that monitoring occurs on a one-year periodic basis fails to meet this requirement, because the term "ongoing basis" implies continual or recurring monitoring activities that occur throughout the system's lifecycle-not a single annual review.

  Therefore, the assessor must determine that the OSC's implementation is not acceptable.

• Question 119:

  An OSC undergoing a CMMC Level 2 assessment has provided a detailed System Security Plan (SSP) and supporting evidence. During the assessment, you notice that the SSP references a practice as being fully implemented, but interviews with staff reveal that the practice is not consistently followed.

  How should the Lead Assessor proceed?

  A. Score the practice as "MET" based on the SSP documentation alone.
  B. Document the inconsistency as an evidence gap and assess the practice based on both documentation and interview findings.
  C. Immediately mark the practice as "NOT MET" due to the staff's statements.
  D. Request the OSC to retrain staff and re-interview them before proceeding.
  B. Document the inconsistency as an evidence gap and assess the practice based on both documentation and interview findings.

• Question 120:

  An aerospace company bids on a DoD contract that requires CMMC Level 2 compliance. The company has multiple divisions, but only the Manufacturing Division will work on the project. The Manufacturing Division has its own IT infrastructure and security policies, but it relies on the company's centralized IT department for some administrative tasks.

  Which of the following is the Host Unit in this scenario?

  A. The Manufacturing Division
  B. The office environment
  C. The entire aerospace company
  D. The company's centralized IT department
  A. The Manufacturing Division