Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 121:

  In ensuring it meets its mandates to protect CUI under CMMC, a contractor has implemented a robust, dynamic session lock with pattern-hiding displays to prevent access and viewing of data. After every 5 minutes of inactivity, the current session is locked and a blank, black screen with a battery life indicator is displayed.

  How is Session Lock typically initiated?

  A. Automatically, after a predefined period of inactivity
  B. By the system administrator manually
  C. Through user authentication processes
  D. Only when manually triggered by the user before leaving their workstation
  A. Automatically, after a predefined period of inactivity

• Question 122:

  During a CMMC Level 2 assessment, the Assessment Team discovers that the OSC has implemented a practice using a tool that is not listed in their System Security Plan (SSP). The tool appears to meet the assessment objectives for the practice, but its absence from the SSP raises concerns about documentation accuracy.

  How should the Lead Assessor proceed?

  A. Accept the tool's use as evidence of compliance and proceed without further action, as it meets the objectives.
  B. Request the OSC to update the SSP to include the tool and provide the revised document before continuing the assessment.
  C. Document the discrepancy as an evidence gap and assess the practice based on the tool's effectiveness, continuing the assessment.
  D. Mark the practice as "NOT MET" due to the inaccurate SSP, regardless of the tool'seffectiveness.
  C. Document the discrepancy as an evidence gap and assess the practice based on the tool's effectiveness, continuing the assessment.

• Question 123:

  John, a CCA, is attending a CMMC industry conference. During a networking event, he makes several inappropriate comments with sexual undertones to a female attendee.

  According to the CoPC's Lawful and Ethical Practices, how should John's behavior be evaluated?

  A. John's comments are acceptable as long as the female attendee does not report them to the Cyber AB.
  B. While unprofessional, John's comments do not violate the CMMC CoPC because they were made at a private industry event.
  C. John's behavior constitutes harassment and discrimination, which violate the CMMC CoPC.
  D. John's behavior is a violation only if he made the comments in connection with his CMMC assessment activities.
  C. John's behavior constitutes harassment and discrimination, which violate the CMMC CoPC.

• Question 124:

  An OSC is preparing for an assessment and wants to gather evidence that will be used by the Lead Assessor to determine the scope of the assessment. The OSC currently operates a hybrid network, with part of their infrastructure at their physical location and part of their infrastructure in a cloud environment.

  What evidence should the OSC collect that would assist the Lead Assessor in determining cloud and hybrid environment constraints?

  A. Subnetworks list
  B. System inventory
  C. Company-owned hardware list
  D. Cloud Service Provider's Customer Responsibility Matrix
  D. Cloud Service Provider's Customer Responsibility Matrix

  ---

  Explanation

  For hybrid and cloud environments, the Customer Responsibility Matrix is the critical artifact. It identifies which security responsibilities are handled by the CSP and which remain with the OSC, directly impacting scope.

  Extract:

  "The OSC must provide responsibility matrices or equivalent documentation that clearly delineates which security controls are the responsibility of the provider and which are retained by the OSC."

  This is necessary for the Lead Assessor to define assessment scope boundaries.

  References:

  CMMC Assessment Guide - Level 2

  Scoping Guidance for Cloud and Hybrid Environments.

• Question 125:

  As a CCA, understanding the guiding principles of the CoPC can help you when you face situations in which you are asked to compromise your values and integrity.

  Which of the following is NOT a guiding principle of the CoPC?

  A. Confidentiality
  B. Professionalism
  C. Availability
  D. Proper Use of Methods
  C. Availability

• Question 126:

  In order to assess whether an OSC meets AC.L2-3.1.5: Least Privilege, what should be examined by the Assessor?

  A. Authentication policy
  B. System configurations for all systems
  C. User access lists that identify privileged users
  D. List of terminated employees over the last three months
  C. User access lists that identify privileged users

  ---

  Explanation

  The requirement of least privilege mandates that users be granted only the access necessary to perform their duties. Assessors confirm compliance by reviewing user access lists, ensuring privileged access is limited, documented, and assigned only where required.

  Exact Extracts:

  AC.L2-3.1.5: "Employ the principle of least privilege, including for specific security functions and privileged accounts."

  Assessment Guide: "Evidence includes user access lists, role-based access assignments, and documentation of privileged accounts." NIST SP 800-171A

  Objective: "Examine system access lists, rights, and permissions for least privilege."

  Why other options are not correct:

  Option A (Authentication policy): Pertains to verifying identity, not enforcing least privilege.

  Option B (System configurations): Provide technical settings, but access lists are the primary evidence for least privilege.

  Option D (Terminated employees list): Tied to AC.L2-3.1.2 (Access enforcement) and AC.L2-3.1.7 (Account management), not least privilege.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: AC.L2-3.1.5 (pp. 17-19). NIST SP 800-171Option A: Assessment procedures for least privilege.

• Question 127:

  A company is seeking Level 2 CMMC certification. During the Limited Practice Deficiency Correction Evaluation, the Lead Assessor must decide whether the company can move to a POA&M review.

  Which condition will result in the Lead Assessor recommending that the OSC's practice deficiencies move to a POA&M review?

  A. A final score below 88
  B. A final score of 110
  C. A final score of 80 or better
  D. A final score of 88/110 or better
  D. A final score of 88/110 or better

  ---

  Explanation

  For CMMC Level 2, an OSC must score at least 88 out of 110 practices (80%) to qualify for use of POA&Ms. Practices on the DoD's Authorized POA&M List may then be deferred, but only if the OSC meets the 88-point threshold and no high-weight practices are failed.

  Exact extracts:

  "Organizations must score at least 88 out of 110 (80%) to be eligible for POA&Ms." "POA&Ms may only be applied to a limited subset of practices designated by DoD." "Failure to reach the 88-point threshold results in an assessment failure."

  Why other options are incorrect:

  Option A: Below 88 is automatic fail.

  Option B: 110/110 is full compliance (no POA&M needed).

  Option C: 80 is a distractor; 88 is the actual DoD threshold.

  References:

  DoD CMMC 2.0 Guidance - POA&M policy.

  CMMC Assessment Guide - Level 2.

• Question 128:

  An assessor is assigned by the Lead Assessor to the pre-assessment template regarding evidence. There are several entries that include how the Assessment Team will identify, obtain, and inventory evidence.

  What else is required to determine readiness to conduct the assessment?

  A. Identify the scope of the OSC.
  B. Delineate what is required to verify the evidence.
  C. Delineate observations by the Assessment Team.
  D. Identify additional people to interview to gather more evidence.
  A. Identify the scope of the OSC.

  ---

  Explanation

  Applicable Requirement (CAP - Pre-Assessment Activities): Before the assessment, the team must confirm the assessment scope (systems, assets, CUI boundaries, and relevant environments). Without scoping, evidence identification and collection cannot be validated.

  Why Option A is Correct: Identifying scope is the foundational requirement in the pre-assessment stage, as defined in the CMMC Assessment Process. Scope determines what systems, people, and assets are included in evidence collection.

  Why Other Options Are Insufficient:

  Option B: Verification of evidence occurs during assessment, not pre-assessment readiness.

  Option C: Observations are recorded during on-site assessment, not beforehand.

  Option D: Interview selection happens during evidence collection, after scope confirmation.

  References (CCA Official Sources):

  CMMC Assessment Process (CAP) v1.0 - Pre-Assessment Phase CMMC Assessment Guide - Level 2, Pre-Assessment Readiness Activities

• Question 129:

  A C3PAO and OSC have agreed to proceed with CMMC assessment planning. The OSC assessment official and the C3PAO are working to determine the planning details and purview of the Assessment, which includes scoping.

  When should the C3PAO and OSC conduct the high-level contract framing?

  A. After the C3PAO has assigned the Lead Assessor and Assessment Team.
  B. At the beginning of their engagement for the CMMC assessment.
  C. During Phase 2 of the CMMC assessment process.
  D. After the OSC has determined the CMMC Assessment Scope.
  B. At the beginning of their engagement for the CMMC assessment.

• Question 130:

  An OSC allows some employees to use their personal devices (laptops, tablets) for work purposes. The OSC enforces a Bring Your Own Device (BYOD) policy that requires employees to install Mobile Device Management (MDM) software on their devices. The MDM allows for remotewiping of lost or stolen devices and enforces access control policies. Employees use VPNs to remotely access the OSC network from their personal devices.

  What challenges might a CCA face when collecting evidence to assess the OSC's compliance with AC.L2- 3.1.12 - Control Remote Access?

  A. The use of MDM software simplifies evidence collection on mobile device security configurations
  B. The use of VPNs ensures a secure connection regardless of the device used for remote access
  C. Privacy concerns arise due to the personal nature of BYOD devices
  D. The CCA can rely solely on employee attestation to verify compliance with the BYOD policy
  C. Privacy concerns arise due to the personal nature of BYOD devices