Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 161:

  The OSC has contracted a C3PAO to perform a CMMC assessment. During Phase 1, the C3PAO discovers that the OSC does not have a Commercial and Government Entity (CAGE) code. The OSC's Assessment Official argues that they have never needed one before and asks what they should do. What should the Lead Assessor tell the OSC Assessment Official?

  A. The OSC must obtain a CAGE code before the assessment can proceed; the C3PAO cannot assist with this process.
  B. The assessment can proceed without a CAGE code, as it is not a strict requirement for CMMC certification.
  C. The C3PAO will assist the OSC in obtaining a CAGE code to ensure the assessment can continue as planned.
  D. The OSC should request a waiver from the DoD to proceed without a CAGE code.
  A. The OSC must obtain a CAGE code before the assessment can proceed; the C3PAO cannot assist with this process.

• Question 162:

  Patrick's company was hired to conduct a CMMC Level 2 assessment for Alto Technologies, where his aunt Jane is the VP of Marketing. Patrick did not disclose his relationship to Jane to his employer because he wanted to work on the Assessment Team and did not think Jane was aware of his job. Which of the following was the most appropriate course of action for Patrick?

  A. Recuse himself without explanation.
  B. Do not disclose the relationship since Jane likely wasn't aware of what he did for work.
  C. Disclose the potential conflict of interest to his employer before being assigned to the assessment.
  D. Follow the specific conflict-of-interest policies at his company.
  C. Disclose the potential conflict of interest to his employer before being assigned to the assessment.

• Question 163:

  You have been sent to assess an OSC's implementation of CMMC practices, one of which is AC.L2-3.1.11 ?Session Termination. In assessing the contractor's implementation of AC.L2-3.1.11, you'll likely need to examine the following specifications, EXCEPT?

  A. Mechanisms for implementing user session termination
  B. The access control policy
  C. The session termination policy
  D. System security plan
  A. Mechanisms for implementing user session termination

• Question 164:

  The OSC implements security measures to control access to printers and manage printed documents. They use a pull-printing system that requires users to authenticate at a designatedprinter to release their print jobs. These printers are installed in a printing press room where only authorized persons have access. To enter the room, individuals must scan their CAC cards. The room housing the printers can be considered what type of location?

  A. Printer location
  B. Logical location
  C. Industrial location
  D. Physical location
  D. Physical location

• Question 165:

  An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1 ?System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet. The following conditions hold true for CMMC practices ineligible for deficiency corrections EXCEPT?

  A. Practices that could lead to significant exploitation of the network or exfiltration of CUI.
  B. Practices that were not implemented by the OSC prior to the current CMMC Assessment.
  C. Practices listed on the OSC's Self-Assessment Practice Deficiency Tracker.
  D. Practices that involve minor updates to existing policies or procedures but have been in place for a period of time.
  D. Practices that involve minor updates to existing policies or procedures but have been in place for a period of time.

• Question 166:

  A software development company uses a cloud-based source code repository and continuous integration/continuous deployment (CI/CD) platform to manage its software development lifecycle. The cloud service provider hosts and manages the source code repository and CI/CD platform. Which of the following statements accurately describes how the OSC should handle the cloud service provider's assets in the CMMC Assessment Scope?

  A. Exclude the cloud provider's assets from the Assessment Scope since they are not owned or managed by the company.
  B. Include the cloud provider's assets in the Assessment Scope as they handle sensitive code.
  C. Include the cloud service provider's assets in the certification boundary but exclude them from the assessment scope.
  D. It depends on the contract between the company and the cloud provider.
  B. Include the cloud provider's assets in the Assessment Scope as they handle sensitive code.

• Question 167:

  The Daily Checkpoint meeting is a required component of the CMMC assessment process. It is conducted at the end of every day and includes the Assessment Team, Lead Assessor, OSC PoC, OSC Assessment Official, and other key personnel. This meeting helps ensure all the following, EXCEPT?

  A. Data collection needs are being met.
  B. Issues impacting the completion of the assessment are identified, mitigated, and resolved.
  C. The C3PAO Assessment Team is comfortable.
  D. The assessment is proceeding as planned.
  C. The C3PAO Assessment Team is comfortable.

• Question 168:

  During a CMMC Level 2 assessment, the Assessment Team discovers that the OSC has implemented a practice using a tool that is not listed in their System Security Plan (SSP). The tool appears to meet the assessment objectives for the practice, but its absence from the SSP raises concerns about documentation accuracy. How should the Lead Assessor proceed?

  A. Accept the tool's use as evidence of compliance and proceed without further action, as it meets the objectives.
  B. Request the OSC to update the SSP to include the tool and provide the revised document before continuing the assessment.
  C. Document the discrepancy as an evidence gap and assess the practice based on the tool's effectiveness, continuing the assessment.
  D. Mark the practice as "NOT MET" due to the inaccurate SSP, regardless of the tool'seffectiveness.
  C. Document the discrepancy as an evidence gap and assess the practice based on the tool's effectiveness, continuing the assessment.

• Question 169:

  While assessing an OSC, you realize they have given identifiers to systems, users, and processes. Examining their documentation, you know they have assigned accounts uniquely to employees, contractors, and subcontractors. The OSC has an automated system that disables any identifiers that are left unused for 6 months. You also learn from interviewing IT security administrators that the OSC has defined a technical and documented policy where identifiers can only be reused after 12 months. How would you score the contractor's implementation of CMMC practice IA.L2-3.5.5 ?Identifier Reuse?

  A. Not Met (-5 points)
  B. Met (+1 point)
  C. Met (+2 points)
  D. Met (+5 points)
  B. Met (+1 point)

• Question 170:

  During a CMMC assessment, the CCAs, CCPs, and Lead Assessor validate the assessment scope provided by the OSC. They must review documents and records specific to the agreed-upon scope and boundaries of the assessment. There are several documents the Assessment Team may review or analyze; some are required, and others not. Which of the following documents is NOT required when scoping a CMMC Assessment for Level 2 maturity?

  A. Network diagrams
  B. System Security Plan (SSP)
  C. Preliminary List of Evidence
  D. System Design documentation
  D. System Design documentation