Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 171:

  The Certification Assessment Readiness Review (CA-RR) aims to determine whether the OSC and the Assessment Team are ready to conduct the assessment as planned and within the allocated time. It addresses all of the following aspects of readiness to conduct the assessment except which one?

  A. OSC cybersecurity posture.
  B. Assessment readiness.
  C. Assessment risk status.
  D. Logistics.
  A. OSC cybersecurity posture.

• Question 172:

  A CCA was part of an Assessment Team tasked with conducting a CMMC assessment for an OSC. Happy to have been part of the team that completed the assessment, the CCA posted the OSC's assessment results on their Twitter/X account. Which CMMC Code of Professional Conduct (CoPC) principle has the CCA violated?

  A. Availability
  B. Proper Use of Methods
  C. Confidentiality
  D. Objectivity
  C. Confidentiality

• Question 173:

  A mid-sized defense supplier has been working to achieve CMMC Level 2 certification. You are part of the Assessment Team contracted to review their documentation and assess their implementation of CMMC practices. During your review, you notice that the OSC has produced documentation for their contractor risk-managed assets. Which of the following is NOT required documentation for contractor risk-managed assets under the CMMC model?

  A. Asset Inventory
  B. Separation methodology
  C. Network Diagram
  D. System Security Plan
  B. Separation methodology

• Question 174:

  A defense contractor retains your services to assess their information systems for CMMC compliance, particularly configuration management. The contractor uses CFEngine 3 for automated configuration and maintenance of its computer systems and networks. While chatting with the network's system admins, you realize they have deployed a modern compliance checking and monitoring tool. However, when examining their configuration management policy, you notice the contractor uses different security configurations than those recommended by product vendors. The system administrator informs you they do this to meet the minimum configuration baselines required to achieve compliance and align with organizational policy. Based on your understanding of the CMMC Assessment Process, how would you score CM.L2-3.4.2 ?Security Configuration Enforcement if the contractor is tracking it in a POAandM?

  A. Not Met
  B. Need more information to score this practice
  C. Met
  D. Not Applicable
  A. Not Met

• Question 175:

  During the initial assessment framing discussions, the OSC POC attempts to sign off on the agreed-upon terms and scope of the assessment, asserting that they have the authority to enter into a legally binding contract with the C3PAO. Which of the following must the C3PAO ascertain before the OSC POC signs off on the agreed terms and scope of the assessment?

  A. That the C3PAO has provided the POC with all necessary training to make binding decisions.
  B. That the POC has decision-making authority within the company and can bind the OSC in agreements with the C3PAO.
  C. That the POC has met the DoD Cyber Workforce Requirements.
  D. That the POC has personally reviewed and approved all the assessment terms and scope details.
  B. That the POC has decision-making authority within the company and can bind the OSC in agreements with the C3PAO.

• Question 176:

  During your review of an OSC's system security control, you focus on CMMC practice SC.L2-3.13.9 ?Connections Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network. The server operating system utilizes default settings for connection timeouts. Network security is managed through a central firewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, there is no documented policy or procedure outlining a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work. Based on the scenario, what is the MOST concerning aspect from a CMMC compliance perspective regarding CMMC practice SC.L2-3.13.9 ?Connections Termination?

  A. The application is hosted on a dedicated server within the company's internal network
  B. Users log in with usernames and passwords, potentially lacking multi-factor authentication
  C. The lack of a documented policy or a defined period of inactivity for terminating remote access connections creates uncertainty and inconsistency
  D. The server operating system utilizes default settings for connection timeouts, which may be insufficient
  C. The lack of a documented policy or a defined period of inactivity for terminating remote access connections creates uncertainty and inconsistency

• Question 177:

  An OSC can use either of the following strategies to meet the requirements of CMMC practice MP.L2-3.8.8 ?Shared Media, EXCEPT?

  A. Permitting unrestricted use of portable storage devices after users complete security awareness training
  B. Ensuring every portable storage device is assigned an owner, project, or department with an identifiable label or registered in a central database
  C. Implementing strong access controls that only allow registered devices to connect to the system
  D. Implementing a strict usage policy that allows for the use of owned portable or owned storage devices
  A. Permitting unrestricted use of portable storage devices after users complete security awareness training

• Question 178:

  You are a Certified CMMC Assessor (CCA) working with a small defense contractor who needs a CMMC Level 2 assessment. This is their first CMMC assessment. During your initial meeting with the OSC, they express a desire for a quick assessment to minimize disruption to their daily operations. They also mention their limited budget for the assessment. How will you proceed with assessment framing in this scenario?

  A. Determine the Rough-Order-of-Magnitude (ROM), by having the C3PAO work with the OSC Assessment Official to determine an anticipated level-of-effort and associated cost estimate to conduct the CMMC Assessment.
  B. Define the specific systems, data, and processes in scope for the assessment.
  C. Negotiate the cost of the assessment with the OSC.
  D. Discuss the assessment timeline and resource requirements with the OSC.
  A. Determine the Rough-Order-of-Magnitude (ROM), by having the C3PAO work with the OSC Assessment Official to determine an anticipated level-of-effort and associated cost estimate to conduct the CMMC Assessment.

• Question 179:

  You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts. If the OSC insists on excluding the subsidiary's network and assets from the CMMC Assessment Scope despite your recommendation to include them, what should you do?

  A. Terminate the Assessment engagement and take further steps to resolve the disagreements.
  B. Escalate the issue to the CMMC Accreditation Body for further guidance and resolution.
  C. Proceed with the Assessment based on the OSC's proposed scope, as the OSC has the final authority to determine the scope.
  D. Include the subsidiary's network and assets in the CMMC Assessment Scope without the OSC'sconsent, as the Lead Assessor has the final authority to determine the scope.
  A. Terminate the Assessment engagement and take further steps to resolve the disagreements.

• Question 180:

  As the Lead Assessor for a CMMC Level 2 assessment team, you have completed the examination of evidence and generated Preliminary Recommended Findings. Now, it is time to submit, package, and archive the assessment documentation, ensuring accuracy, completeness, and adherence to protocol. According to the CMMC Assessment Process, how long after the Final Findings Briefing must you submit the Assessment Results Package to the C3PAO CQAP?

  A. 20 business days
  B. 30 business days
  C. 10 business days
  D. 15 business days
  C. 10 business days