Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 161:

  You are part of the team conducting a CMMC assessment for an OSC. Because of the sensitive nature of the OSC's technologies, your team signed an NDA. However, you observe one of the Assessment Team members copying something from the OSC's computer systems. You know they don't have permission because the NDA states that the OSC POC will provide any required material.

  What should you do in this case?

  A. Inform the OSC of the incident.
  B. Allow them to copy the files.
  C. Approach the team member and remind them of their confidentiality obligations under the CoPC.
  D. Report the team member to the Cyber AB.
  C. Approach the team member and remind them of their confidentiality obligations under the CoPC.

• Question 162:

  An OSC uses a third party in all system repairs and has hired an MSP for penetration testing. The third party comes for either adaptive, preventative, perfective, or corrective system maintenance every three months, and the penetration tester does so continuously. Whenever the third party comes for maintenance, there's no documentation of the issues they tackled. On the other hand, the penetration tester delivers meticulously detailed documentation per their contract with the OSC.

  To comply with CMMC practice MA.L2- 3.7.1 - Perform Maintenance, what should the OSC implement for the maintenance activities performed by the third-party vendor?

  A. Increase the frequency of maintenance activities to monthly intervals
  B. Perform all maintenance activities in-house without relying on a third-party vendor
  C. Require the third-party vendor to provide detailed maintenance logs and records
  D. Discontinue the use of the MSP for penetration testing
  C. Require the third-party vendor to provide detailed maintenance logs and records

• Question 163:

  During a CMMC assessment for an OSC, the Point of Contact (POC) mentioned they conducted a self-assessment beforehand. The self-assessment was part of the organization's preparations for the CMMC assessment by your C3PAO.

  Which publication offers the best guidance for the self-assessment procedures OSCs might use for CMMC compliance?

  A. DFARS Clause 252.204-7012
  B. NIST SP 800-171
  C. NIST SP 800-172
  D. NIST SP 800-171A
  D. NIST SP 800-171A

• Question 164:

  The Daily Checkpoint meeting is a required component of the CMMC assessment process. It is conducted at the end of every day and includes the Assessment Team, Lead Assessor, OSC PoC, OSC Assessment Official, and other key personnel.

  This meeting helps ensure all the following, EXCEPT?

  A. Data collection needs are being met.
  B. Issues impacting the completion of the assessment are identified, mitigated, and resolved.
  C. The C3PAO Assessment Team is comfortable.
  D. The assessment is proceeding as planned.
  C. The C3PAO Assessment Team is comfortable.

• Question 165:

  The OSC prints out documents it receives via email that are marked as CUI.

  According to MP.L2-3.8.4: Media Markings, what should the Assessor expect to see on the printouts?

  A. A red stamp that states the document contains CUI
  B. Written limitations to the distribution of the CUI within the OSC
  C. The original markings that were on the document emailed to the OSC
  D. The original markings from the document and a distribution list with limitations
  C. The original markings that were on the document emailed to the OSC

  ---

  Explanation

  MP.L2-3.8.4 requires that CUI markings follow the media, meaning when electronic documents are printed, the original markings must carry over to the hard copy. Distribution lists or colored stamps are not specifically required.

  Extract:

  "Mark media containing CUI with the CUI designation indicators as required. When converting CUI from one medium to another, the original markings must be retained."

  Thus, the assessor should expect to see the original markings carried onto the printouts.

• Question 166:

  An OSC plans to bid for a DoD contract to supply laser welding services to repair a fleet of unmanned aerial vehicles (UAVs). This requires them to be CMMC Level 2 certified since the information they will receive from the DoD is Controlled Technical Information (CTI). However, their repair and welding services require a Computer Numerical Control (CNC) machine to fabricate some crucial parts. Since the welding is mainly automated using robots, the OSC has intelligently integrated its SCADA system with Programmable Logic Controllers (PLCs) for increased accuracy, improved safety and efficiency, and enhanced flexibility.

  If the OSC wins the contract, how will the banner marking on documents containing CUI from the DoD be structured?

  A. CUI//SP-CTI
  B. CUI//CTI
  C. CUI/SP-CTI
  D. CUI-SP//CTI
  A. CUI//SP-CTI

• Question 167:

  An OSC has documented HR and personnel security policies, which are well integrated. A key requirement is that credentials and systems are revoked upon a transfer or termination. Their personnel security policy includes procedures for transfer and termination, a list of system accounts tied to each employee, and management of revoked or terminated credentials and authenticators. Examining the procedures addressing personnel transfer and termination, you learn that besides revoking or terminating system access, authenticators, and credentials, the OSC recovers all company IT equipment, access/ identification cards, and keys from the transferred or terminated employee. They also interview the employee to remind them of their CUI handling obligations even after transfer and require them to sign an NDA. After every termination, they also change the password and other access control mechanisms and notify all the stakeholders that the employee has been terminated or transferred.

  Based on the scenario, the OSC can cite the following as evidence of collaborating on their implementation of CMMC practice PS.L2- 3.9.2 - Personnel Actions, EXCEPT?

  A. List of usernames and passwords of all the employees
  B. Records of personnel transfer and termination actions
  C. Records of exit interviews accompanied by a list of terminated employees' identifiers
  D. Records of terminated or revoked authenticators and credentials
  A. List of usernames and passwords of all the employees

• Question 168:

  When assessing an environment, the CCA determines that CUI is contained within an IoT device.

  Which statement MUST be true?

  A. The IoT device is a Contractor Risk Managed Asset.
  B. The IoT device must be accurately documented within the SSP.
  C. An IoT device may not be utilized to process, store, or transmit CUI.
  D. Access provisioned to the IoT device must be done in accordance with AC.L2-3.1.1: Limit System Access.
  B. The IoT device must be accurately documented within the SSP.

  ---

  Explanation

  When an IoT device processes, stores, or transmits CUI, it is categorized as a CUI Asset (not CRMA). All in-scope assets must be documented in the System Security Plan (SSP). The SSP must identify how the asset is managed, secured, and integrated into the OSC's environment.

  Exact Extracts:

  CMMC Scoping Guide: "All CUI Assets must be identified and described in the SSP." "Specialized Assets (including IoT) must be documented in the SSP if they process, store, or transmit CUI.""Contractor Risk Managed Assets do not include assets that process, store, or transmit CUI."

  Why other options are not correct:

  Option A: Incorrect, because an IoT device with CUI cannot be a CRMA.

  Option C: Incorrect, IoT can process CUI if properly secured and documented.

  Option D: While true in general (AC control applies), the mandatory requirement is accurate SSP documentation.

  References:

  CMMC Assessment Scope - Level 2, Version 2.13: Asset categories (pp. 5-10).

  CMMC Assessment Guide - Level 2: SSP documentation requirements.

• Question 169:

  An OSC receives a POA&M during their CMMC L2 assessment. 170 days later, they submit an updated POA&M with evidence of all corrective actions.

  Can the C3PAO still conduct a close-out assessment?

  A. No, the 180-day window has closed.
  B. No, the OSC must wait for the next assessment cycle.
  C. Yes, as long as all corrective actions are verified.
  D. Yes, but the OSC must re-perform the entire CMMC L2 assessment.
  C. Yes, as long as all corrective actions are verified.

• Question 170:

  A CCA is reviewing an OSC's evidence for a CMMC practice and finds that the documentation is in draft form, marked "For Internal Use Only," and lacks final approval. The OSC insists it is actively used.

  How should the CCA evaluate this evidence?

  A. Accept the draft documentation as sufficient since it is actively used.
  B. Document the lack of final approval as an evidence gap and assess based on all available evidence, including usage confirmation.
  C. Reject the draft documentation and score the practice as "NOT MET."
  D. Request the OSC to finalize the documentation before continuing the assessment.
  B. Document the lack of final approval as an evidence gap and assess based on all available evidence, including usage confirmation.