Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 141:

  A DoD contractor developing guidance and targeting systems has subcontracted a data analytics company to analyze their data accuracy. How should the DoD contractor handle the analytics company when preparing a CMMC assessment scope?

  A. Include only assets of the analytics company that deal with their equipment data analytics.
  B. Include the entire analytics company in the assessment scope.
  C. Terminate their engagement with the analytics company during the assessment process.
  D. Do not include the analytics company in the CMMC assessment scope.
  A. Include only assets of the analytics company that deal with their equipment data analytics.

• Question 142:

  You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment. What does the criterion of `Adequacy' primarily assess in the context of evidence collection for a CMMC assessment?

  A. The OSC's overall cybersecurity policy comprehensiveness.
  B. The quantity of evidence available for each CMMC practice.
  C. The evidence is relevant and demonstrates performance of a CMMC practice.
  D. The quality of the cybersecurity measures in place at the OSC.
  C. The evidence is relevant and demonstrates performance of a CMMC practice.

• Question 143:

  While examining a contractor's audit and accountability policy, you realize they have documented types of events to be logged and defined content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activities. After the logs are analyzed, the results are fed into a system that automatically generates audit records stored for 30 days. However, mechanisms implementing system audit logging are lacking after several tests because they produce audit logs that are too limited. You find that generated logs cannot be independently used to identify the event they resulted from because the defined content specified therein is too limited. Additionally, you realize the logs are retained for 24 hours before they are automatically deleted. Which of the following is a potential assessment method for AU.L2- 3.3.1 ?System Auditing?

  A. Examine procedures addressing audit record generation
  B. Testing procedures addressing control of audit records
  C. Testing the system configuration settings and associated documentation
  D. Examining the mechanisms for implementing system audit logging
  A. Examine procedures addressing audit record generation

• Question 144:

  An OSC undergoing a CMMC Level 2 assessment has provided a detailed System Security Plan (SSP) and supporting evidence. During the assessment, you notice that the SSP references a practice as being fully implemented, but interviews with staff reveal that the practice is not consistently followed. How should the Lead Assessor proceed?

  A. Score the practice as "MET" based on the SSP documentation alone.
  B. Document the inconsistency as an evidence gap and assess the practice based on both documentation and interview findings.
  C. Immediately mark the practice as "NOT MET" due to the staff's statements.
  D. Request the OSC to retrain staff and re-interview them before proceeding.
  B. Document the inconsistency as an evidence gap and assess the practice based on both documentation and interview findings.

• Question 145:

  Understanding that changes are critical in any production environment, a DoD contractor has instituted measures to manage them. All software changes can only be implemented by defined individuals. These changes must have gone through a rigorous change approval process and must be implemented from a secure server located in the company's headquarters. The personnel affecting the changes access the server room using access cards and an iris scan. To log into the server, they must enter their passwords to receive a one-time password (OTP), which must be keyed in within 2 minutes. After any changes are made, the chairperson of the contractor's Change Review Board and the CISO get a notification to approve the changes before they take effect. Based on the contractor's current implementation, how would you score their effort to address CM.L2-3.4.5 ?Access Restrictions for Change?

  A. Met (+1 point)
  B. Met (+5 points)
  C. Met (+3 points)
  D. Not Met (-5 points)
  B. Met (+5 points)

• Question 146:

  During a CMMC Level 2 assessment, an OSC receives a Conditional Certification with several practices placed on a Plan of Action and Milestones (POAandM). After implementing corrective actions, the OSC requests the Assessment Team to conduct a POAandM Close- Out Assessment. Which of the following is the correct action for the Team's Lead Assessor during the POAandM Close-Out Assessment?

  A. Recommend the organization for CMMC Level 2 Final Certification if all POAandM items arefully implemented and do not limit the effectiveness of other practices scored as 'MET' during the initial assessment.
  B. Recommend the organization for CMMC Level 2 Final Certification if all POAandM items have been fully implemented and meet the required criteria.
  C. Recommend the organization for CMMC Level 2 Final Certification regardless of the POAandM items' impact on other practices.
  D. Recommend the organization reapply for CMMC Level 2 Certification, even if all POAandM items are fully implemented.
  A. Recommend the organization for CMMC Level 2 Final Certification if all POAandM items arefully implemented and do not limit the effectiveness of other practices scored as 'MET' during the initial assessment.

• Question 147:

  A CMMC assessment involves testing, examining, and interviewing various assessment objects. The definition of an assessment object is provided in NIST SP 800-171A. Which of the following can an Assessment Object NOT be?

  A. Activities
  B. Specifications
  C. Individuals
  D. Examine
  D. Examine

• Question 148:

  You are a Lead Assessor working with your C3PAO to conduct a CMMC Assessment for an OSC. During the preparation and planning phase, you meet with the OSC's Assessment Official to identify the resources and schedule for the upcoming assessment. Together, you review the OSC's pre-assessment information to estimate the level of effort required. You then collaborate to determine the specific resources needed, including the Assessment Team members, facilities, and any support personnel from the OSC. You also discuss scheduling factors like duration, key activities, and potential constraints. Based on these discussions, you develop a Rough Order of Magnitude (ROM) cost estimate and a proposed daily schedule for the assessment activities. Which of the following is not a requirement when identifying resources and schedules?

  A. Documenting the names and roles of all assessment participants.
  B. Recording the facilities to be used and their configurations.
  C. Negotiating the pricing structure of the contract with the OSC.
  D. Identifying potential triggers for replanning or updating the assessment plan.
  C. Negotiating the pricing structure of the contract with the OSC.

• Question 149:

  Conducting a CMMC assessment for an OSC includes interviewing, testing, or examining various Assessment Objects. As a CCA, you are part of an Assessment Team tasked with evaluating how an OSC has implemented AC.L2-3.1.4 ? Separation of Duties. Which of the following is not an Assessment Object you would use to validate the OSC's implementation of AC.L2-3.1.4[a], "the duties of individuals requiring separation to reduce the risk of malevolent activity are defined"?

  A. Personnel responsible for defining divisions of responsibility and separation of duties
  B. Mechanisms that implement system audit logging
  C. The organization's Access Control Policy
  D. Mechanisms implementing the separation of duties policy
  B. Mechanisms that implement system audit logging

• Question 150:

  Change is a part of any production process and must be meticulously managed. System Change Management is a CMMC requirement, and you have been called in to assess the implementation of CMMC requirements. When examining the contractor's change management policy, you realize there is a defined change advisory board that has a review and approval mandate for any proposed changes. The change advisory board maintains a change request system where all the changes are submitted and documented for easy tracking and review. The contractor also has a defined rollback plan defining what to do in case the approved changes result in unexpected issues or vulnerabilities. What evidence artifacts can the contractor also cite as evidence to show their compliance with CM.L2- 3.4.3 ?System Change Management besides their change management policy?

  A. Employee satisfaction surveys regarding the change management process
  B. System uptime statistics showing improved stability after change management implementation
  C. Organizational procedures addressing system configuration change control and change control/audit review reports
  D. Antivirus scan reports detailing detected and quarantined threats
  C. Organizational procedures addressing system configuration change control and change control/audit review reports