Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 151:

  During the assessment process, a CCA encounters a situation in which the evidence provided by the OSC raises concerns about its adequacy and alignment with the CMMC practice being assessed.

  What priority factors must the CCA have considered to arrive at these concerns?

  A. The format and presentation of the evidence
  B. The completeness of the evidence across all systems and processes
  C. The level of detail and granularity provided in the evidence
  D. Whether the evidence is the right evidence and meets the intent of the CMMC practice
  D. Whether the evidence is the right evidence and meets the intent of the CMMC practice

• Question 152:

  During the Planning phase, the C3PAO and Lead Assessor will collect information from the OSC to provide a Rough Order of Magnitude (ROM). This enables the Assessor to approximate the duration, schedule, and cost of the Assessment.

  To determine the Rough Order of Magnitude (ROM), the Lead Assessor can use the following inputs, EXCEPT?

  A. The OSC's location and number of facilities.
  B. Education levels of the Assessment Team.
  C. The size and complexity of the OSC.
  D. The OSC's readiness.
  B. Education levels of the Assessment Team.

• Question 153:

  As a Lead Assessor working with an OSC in preparation for an upcoming assessment, you request they appoint an Assessment Official. This is the individual you will collaborate with and who has the OSC's decision-making authority regarding the CMMC assessment. The OSC Assessment Official will lead and manage the OSC's engagement in the assessment.

  As the Lead Assessor, you expect the OSC Assessment Official to have the following responsibilities, EXCEPT?

  A. Identify assessment funding and authorize payment.
  B. Sign off on the assessment scope and boundaries.
  C. Approve the assessment plan and review assessment results with the Lead Assessor.
  D. Handle facility access and daily visitor escort.
  D. Handle facility access and daily visitor escort.

• Question 154:

  A company is undergoing a CMMC Level 2 Assessment. The Assessment Team is planning and preparing the assessment.

  Who is responsible for identifying methods, techniques, and responsibilities for collecting, managing, and reviewing evidence?

  A. Lead Assessor
  B. Assessment Team Member
  C. C3PAO Quality Oversight Manager
  D. CMMC Quality Assurance Professional
  A. Lead Assessor

  ---

  Explanation

  The Lead Assessor is responsible for managing the assessment team and planning the assessment, including defining the methods, techniques, and responsibilities for collecting, managing, and reviewing evidence. Team members execute assigned tasks, but the Lead Assessor provides direction and oversight.

  Exact Extracts:

  CMMC Assessment Guide: "The Lead Assessor is responsible for the management of the assessment, including defining evidence collection methods, techniques, and responsibilities." "The assessment team members carry out activities as directed by the Lead Assessor." "The C3PAO Quality Oversight and CMMC Quality Assurance are post-assessment quality functions, not evidence planning functions."

  Why other options are not correct:

  Option B: Team members execute tasks but do not define methods and responsibilities.

  Option C: Quality Oversight Managers review assessments after completion, not during planning.

  Option D: CMMC Quality Assurance Professionals conduct QA on assessments, not evidence planning.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: Assessment planning roles and responsibilities (pp.4- 6).

• Question 155:

  Implementation of and compliance with CMMC practices is not just a one-time effort but a sustained and habitual practice within the organization. As a CCA, you are part of an Assessment Team conducting a CMMC assessment for an OSC. As part of the assessment process, the CCA must confirm that the OSC has persistently implemented the CMMC policies and practices across all levels of the organization.

  To validate the persistent implementation of CMMC policies and practices, which of the following sources of evidence should you primarily focus on?

  A. The OSC's training programs and resource allocation for CMMC implementation
  B. Interviews with personnel to gauge their awareness and understanding of CMMC practices
  C. The OSC's policy documents and executive-level communications
  D. A combination of policies, plans, resourcing, communications, and training that are elements of the organization's cybersecurity program
  D. A combination of policies, plans, resourcing, communications, and training that are elements of the organization's cybersecurity program

• Question 156:

  An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1 - System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet.

  What is the Assessment Team's initial finding regarding the OSC's implementation of CM.L2-3.4.1 - System Baselining, and how should it be scored?

  A. NOT MET (Deduct 3 points)
  B. Not Applicable
  C. NOT MET (Deduct 1 point)
  D. NOT MET (Deduct 5 points)
  D. NOT MET (Deduct 5 points)

• Question 157:

  As the Lead Assessor for a CMMC Level 2 assessment team, you have completed the examination of evidence and generated Preliminary Recommended Findings. Now, it is time to submit, package, and archive the assessment documentation, ensuring accuracy, completeness, and adherence to protocol.

  According to the CMMC Assessment Process, how long after the Final Findings Briefing must you submit the Assessment Results Package to the C3PAO CQAP?

  A. 20 business days
  B. 30 business days
  C. 10 business days
  D. 15 business days
  C. 10 business days

• Question 158:

  A contractor plans to bid for a DoD contract and has installed new network file servers to separate their commercial and DoD work. When examining the server documentation, you realize that the server has some open ports. Upon further testing, you determine that the server has some default features that are not essential for file storage or transfer. The server has a default remote desktop functionality that allows users remote access to the server's desktop environment. Files are transferred by default using FTP, which is less secure than the Server Message Block (SMB) protocol. However, the contractor's operations do not require remote access capabilities. Although the roles of each system are defined in their configuration management policy, a user can install any application or service they need. After some interviews, you learn that this ensures every employee is comfortable using a system or software they are most conversant with, despite having defined services or software for carrying out specific functions.

  Upon speaking with the OSC PoC when assessing CM.L2-3.4.6 - Least Functionality, they acknowledge deficiencies, place the practice in a POA&M, and request that you grant conditional certification.

  How would you respond?

  A. Offer to provide consulting services to help them meet CM.L2-3.4.6 - Least Functionality quickly
  B. Politely decline the OSC's request and inform them that CM.L2-3.4.6 - Least Functionality cannot be placed in a POA&M. Also, inform them that granting conditional CMMC certification when they do not meet the requirement is in violation of the CMMC Code of Professional Conduct (CoPC)
  C. Walk out of the assessment and file a conflict of interest with the CMMC AB
  D. Grant them conditional certification
  B. Politely decline the OSC's request and inform them that CM.L2-3.4.6 - Least Functionality cannot be placed in a POA&M. Also, inform them that granting conditional CMMC certification when they do not meet the requirement is in violation of the CMMC Code of Professional Conduct (CoPC)

• Question 159:

  You are a CCA participating in an assessment exercise for an OSC. You have completed the exercise, and the OSC has hashed the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide.

  What is the next step for your Assessment Team with respect to the Evidence Artifact Hashes?

  A. Tell the OSC to encrypt the hash.
  B. Upload the Hashes to the OSC's CMMC eMASS.
  C. Upload them to your C3PAO's cloud instance.
  D. Nothing, the assessment is complete.
  B. Upload the Hashes to the OSC's CMMC eMASS.

• Question 160:

  In assessing the security boundaries, you determine that an OSC processes, stores, and transmits CUI and FCI within the same assessment scope.

  To what maturity level will you at a minimum assess and certify the OSC?

  A. CMMC Level 2
  B. You should refer the OSC to Cyber AB.
  C. The OSC must separate the scope for assets that process, store, or transmit CUI from those that handle FCI.
  D. CMMC Level 1
  A. CMMC Level 2