Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 121:

  You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts. If the OSC shares proprietary information with the Lead Assessor during the assessment engagement, what is the C3PAO's responsibility regarding this information after the completion of the assessment?

  A. The C3PAO can share the OSC's proprietary information with other clients for benchmarking purposes.
  B. The C3PAO can retain the OSC's proprietary information for future reference and use.
  C. The C3PAO is not responsible for the OSC's proprietary information once the Assessment is completed.
  D. The C3PAO must return and/or destroy any OSC proprietary information.
  D. The C3PAO must return and/or destroy any OSC proprietary information.

• Question 122:

  A CCA receives a notification from the Cyber AB that they are being investigated for a potential violation of the CoPC. They are concerned about the potential consequences and want to understand the process better. Who has the final authority to determine the corrective action taken against a CCA, if any?

  A. The investigator assigned to the CCA's case.
  B. The CMMC Accreditation Body (the Cyber AB).
  C. The C3PAO.
  D. The Lead Assessor.
  B. The CMMC Accreditation Body (the Cyber AB).

• Question 123:

  During the Planning phase, the C3PAO and Lead Assessor will collect information from the OSC to provide a Rough Order of Magnitude (ROM). This enables the Assessor to approximate the duration, schedule, and cost of the Assessment. To determine the Rough Order of Magnitude (ROM), the Lead Assessor can use the following inputs, EXCEPT?

  A. The OSC's location and number of facilities.
  B. Education levels of the Assessment Team.
  C. The size and complexity of the OSC.
  D. The OSC's readiness.
  B. Education levels of the Assessment Team.

• Question 124:

  A C3PAO has hired a full-time CCA and included them in an Assessment Team sent to conduct a CMMC assessment. However, as part of their agreement with Cyber AB, the CCA and, by extension, the C3PAO are expected to uphold a set of values during the assessment. What document sets the expectations for accredited and credentialed entities authorized to deliver CMMC services under Cyber AB licensing?

  A. Code of Professional Control
  B. CMMC Code of Professional Conduct
  C. CMMC Code of Ethical Conduct
  D. Code of Ethical Conduct
  B. CMMC Code of Professional Conduct

• Question 125:

  A leading technology solutions provider that works with various government agencies and commercial clients has implemented a dedicated CUI enclave within its network infrastructure to ensure the secure handling of CUI. As a Certified CMMC Assessor, you are tasked with assessing the scope of the solutions provider's CMMC requirements. Which separation technique can the technology solutions provider use to isolate the network assets in its CUI enclave?

  A. Physical separation
  B. Segmentation
  C. Logical isolation
  D. Encryption
  C. Logical isolation

• Question 126:

  You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. During the evidence collection phase, you need to examine the OSC's policies and procedures related to the CMMC practice AC.L2-3.1.5 ?Least Privilege. Which of the following would be an appropriatesource of evidence for this practice?

  A. Testing the OSC's Role-Based Access Control (RBAC) and Privilege Access Management (PAM) tools.
  B. Observing the system administrators as they configure the systems.
  C. Examining the organization's system configuration documentation.
  D. Interviewing the system administrators about their daily activities.
  C. Examining the organization's system configuration documentation.

• Question 127:

  As a Lead Assessor working with an OSC in preparation for an upcoming assessment, you request they appoint an Assessment Official. This is the individual you will collaborate with and who has the OSC's decision-making authority regarding the CMMC assessment. The OSC Assessment Official will lead and manage the OSC's engagement in the assessment. As the Lead Assessor, you expect the OSC Assessment Official to have the following responsibilities, EXCEPT?

  A. Identify assessment funding and authorize payment.
  B. Sign off on the assessment scope and boundaries.
  C. Approve the assessment plan and review assessment results with the Lead Assessor.
  D. Handle facility access and daily visitor escort.
  D. Handle facility access and daily visitor escort.

• Question 128:

  While assessing an OSC, you realize they have given identifiers to systems, users, and processes. Examining their documentation, you know they have assigned accounts uniquely to employees, contractors, and subcontractors. The OSC has an automated system that disables any identifiers that are left unused for 6 months. You also learn from interviewing IT security administrators that the OSC has defined a technical and documented policy where identifiers can only be reused after 12 months. How is the OSC likely to consider CMMC practice IA.L2-3.5.5 ?Identifier Reuse if you find issues with its implementation?

  A. List it in their SSP
  B. Track it under limited deficiency correction
  C. Hire another C3PAO to verify your assessment
  D. Disregard it as it is not applicable
  B. Track it under limited deficiency correction

• Question 129:

  An OSC previously received a Conditional CMMC Level 2 Certification during Phase 3 of the assessment process. The OSC has been working on implementing a POAandM to address the practice deficiencies identified during the initial assessment. Now, within 180 days from the Final Recommended Findings Briefing, you are to conduct a POAandM Closeout Assessment. As the Lead Assessor, you and your assessment team review the OSC's updated POAandM, accompanying evidence, and any scheduled observations, interviews, or tests with the aim of validating the implementation of the corrective actions. If the Organization Seeking Certification (OSC) disagrees with the C3PAO's findings during the POAandM Closeout Assessment, what is the recourse?

  A. Immediately reapply for CMMC Level 2 certification with a different C3PAO.
  B. Submit an appeal using the Assessment Appeals Process outlined in the CAP.
  C. Request an extension of the timeline for corrective actions.
  D. Demand a reassessment by the same C3PAO and Lead Assessor.
  B. Submit an appeal using the Assessment Appeals Process outlined in the CAP.

• Question 130:

  You are assessing an OSC that utilizes containerization technology for deploying microservices within a Kubernetes cluster. These microservices leverage various JavaScript frameworks for functionality. While a mobile device management (MDM) solution secures company phones, access to these microservices is primarily through web interfaces. From a mobile code control perspective, what is the primary concern in this scenario?

  A. The lack of mobile device management (MDM) for access through web interfaces
  B. Containerization technology itself might introduce security vulnerabilities
  C. The use of JavaScript in containerized microservices
  D. The potential execution of unauthorized mobile code through web interfaces
  D. The potential execution of unauthorized mobile code through web interfaces