Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 181:

  An OSC is undergoing a CMMC assessment by a C3PAO. The assessment team has been on-site for several days, reviewing the OSC's systems, policies, and procedures against the CMMC requirements.

  Each day, the assessment team holds a "daily checkpoint" meeting with the OSC's security team and representatives. This checkpoint serves an important purpose in the overall assessment process.

  What is the significance of the Daily Checkpoint meeting in the CMMC assessment process?

  A. It allows the Lead Assessor to finalize the assessment findings independently.
  B. It is optional and not necessary for the assessment process.
  C. It is solely for updating the OSC on the assessment progress.
  D. It provides an opportunity for the Assessment Team to review and verify additional evidence.
  D. It provides an opportunity for the Assessment Team to review and verify additional evidence.

• Question 182:

  The Cyber AB is the sole authorized certification and accreditation partner for the DoD in its CMMC program. It is responsible for overseeing and establishing a trained, qualified, and high-fidelity community of assessors, including C3PAOs and CCAs.

  What is the main requirement before.

  The Cyber AB can accredit an Assessor?

  A. The Cyber AB must be DFARS 7012 compliant.
  B. The Cyber AB must be compliant at a FISMA moderate level.
  C. The Cyber AB must achieve and maintain ISO/IEC 17011 accreditation standard.
  D. The Cyber AB must be approved by the DoD.
  C. The Cyber AB must achieve and maintain ISO/IEC 17011 accreditation standard.

• Question 183:

  Documentation is a key aspect of the CMMC assessment. When preparing for a prospective assessment and during the actual CMMC assessment, you will reference various documents and document various findings. Fortunately, you can download some of these documents from the DoD CIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC's preparedness and readiness for a CMMC assessment.

  Which document/template includes the OSC's evidence, assets, and CMMC assessment scope, among other data?

  A. CMMC Assessment In-Brief
  B. The OSC Data Form
  C. CMMC Assessment Findings Briefing
  D. CMMC Pre-Assessment Form Template
  D. CMMC Pre-Assessment Form Template

• Question 184:

  You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts.

  If the OSC shares proprietary information with the Lead Assessor during the assessment engagement, what is the C3PAO's responsibility regarding this information after the completion of the assessment?

  A. The C3PAO can share the OSC's proprietary information with other clients for benchmarking purposes.
  B. The C3PAO can retain the OSC's proprietary information for future reference and use.
  C. The C3PAO is not responsible for the OSC's proprietary information once the Assessment is completed.
  D. The C3PAO must return and/or destroy any OSC proprietary information.
  D. The C3PAO must return and/or destroy any OSC proprietary information.

• Question 185:

  A company has four waterjet machines with very limited computing capabilities. The company loads CUI onto these machines for machining parts and uses CUI as necessary for machining.

  Should these waterjet machines be part of the CMMC Assessment?

  A. No, these waterjet machines are Out-of-Scope Assets and do not need to be assessed.
  B. Yes, these waterjet machines are CUI Assets that must be assessed because they handle CUI.
  C. Yes, these waterjet machines are Specialized Assets that are within the scope of a CMMC Assessment.
  D. No, these waterjet machines are Contractor Risk Managed Assets and do not need to be assessed.
  C. Yes, these waterjet machines are Specialized Assets that are within the scope of a CMMC Assessment.

  ---

  Explanation

  The CMMC Scoping Guidance defines Specialized Assets (e.g., OT, IoT, test equipment, manufacturing machines) that may process CUI but do not always meet traditional IT security requirements. These assets are still within scope and must be documented and assessed as Specialized Assets.

  Extract:

  "Specialized Assets are defined as operational technology, IoT, test equipment, and similar devices that may process CUI but cannot be secured in the same manner as standard assets. They remain in-scope for the assessment."

  Thus, waterjet machines are Specialized Assets in scope.

• Question 186:

  A software development company wins a DoD contract requiring CMMC Level 2. The company is small and has one main office. However, it outsources some data storage requirements to a cloud service provider (CSP).

  What type of organization would the cloud service provider be considered in the CMMC assessment scope?

  A. A Supporting Unit
  B. An Enclave
  C. The Host Unit
  D. The HQ Organization
  A. A Supporting Unit

• Question 187:

  The OSC implements security measures to control access to printers and manage printed documents.

  They use a pull-printing system that requires users to authenticate at a designatedprinter to release their print jobs. These printers are installed in a printing press room where only authorized persons have access. To enter the room, individuals must scan their CAC cards.

  The room housing the printers can be considered what type of location?

  A. Printer location
  B. Logical location
  C. Industrial location
  D. Physical location
  D. Physical location

• Question 188:

  An OSC is undergoing a CMMC Level 2 assessment, and the C3PAO Assessment Team has identified several practices that the organization has not yet fully implemented. During the assessment, the CCA notes significant progress by the OSC towards implementing control MP.L2-3.8.4 - Media Markings, but acknowledges that not all required steps have been completed. The CCA explains to the OSC that this partially implemented practice will need to be tracked in theLimited Practice Deficiency Correction Program.

  How should CMMC practices tracked under the Limited Practice Deficiency Correction Program be scored?

  A. Not Met
  B. Partially Met
  C. Not Applicable
  D. Met
  A. Not Met

• Question 189:

  Does CMMC Level 2 require that a Cloud Service Provider (CSP) hold a FedRAMP HIGH authorization hosted in a government community cloud (GCC)?

  A. No. The CSP can obtain a FedRAMP MODERATE equivalency.
  B. No. The CSP must hold a FedRAMP MODERATE authorization.
  C. Yes. FedRAMP HIGH is required for CUI data controls due to the sensitive nature of the Defense Industrial Base systems.
  D. Yes. FedRAMP HIGH authorization demonstrates the CSP compliance with NIST SP 800-53 and SP 800-171 control requirements.
  B. No. The CSP must hold a FedRAMP MODERATE authorization.

  ---

  Explanation

  CMMC Level 2 requires CSPs that process, store, or transmit CUI to meet FedRAMP Moderate (or equivalent) authorization, not FedRAMP High. FedRAMP High is not a CMMC requirement but may be required by contract or specific agencies.

  Exact Extracts:

  DoD CMMC Scoping Guide: "External Cloud Service Providers must meet FedRAMP Moderate equivalency when storing, processing, or transmitting CUI." CMMC Assessment Guide: "The baseline requirement for CUI in cloud environments is FedRAMP Moderate; higher levels may be contractually required."

  Why other options are not correct:

  Option A: Equivalency is allowed, but only to FedRAMP Moderate level.

  Option C/D: Incorrect, because CMMC Level 2 does not mandate FedRAMP High.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: External Service Providers and FedRAMP Moderate equivalency requirements.

  DoD Cloud Computing SRG (referenced in CMMC documentation): CUI requires FedRAMP Moderate baseline.

• Question 190:

  An OSC has a headquarters (HQ) site and satellite offices A and

  B. The two satellite offices are connected to the HQ through a VPN. CUI is stored within the HQ LAN room and used by staff at HQ and Site

  A. and Site A contain CUI assets and Site B is out of scope.
  B. and Site A and Site B contain CUI assets since all have access to CUI.
  C. contain CUI assets and Site A and Site B contain only Certification in Risk Management Assurance.
  D. and Site A contain CUI assets and Site B contains only Certification in Risk Assurance.
  A. and Site A contain CUI assets and Site B is out of scope.

  ---

  Explanation

  In CMMC scoping, assets are categorized based on where CUI is processed, stored, or transmitted.

  According to the CMMC Scoping Guide for Level 2, if CUI is only stored and used in HQ and Site A, those locations contain CUI Assets.

  Since Site B neither stores, processes, nor transmits CUI, its assets are considered Out of Scope.

  Exact extracts:

  "CUI Assets are those that store, process, or transmit CUI."

  "Assets that do not process, store, or transmit CUI, and cannot provide access to CUI, are considered Out-of-Scope." "Only those assets in the scope of CMMC assessment will be evaluated against practices."

  Why the other options are incorrect:

  Option B: Site B has VPN connectivity, but if it does not use or process CUI, its assets remain out of scope.

  Connectivity alone does not bring it into scope.

  Option C/D: The terms "Certification in Risk Management Assurance" are not valid CMMC asset categories.

  References (CCA documents / Study Guide):

  CMMC Assessment Scope - Level 2 Scoping Guide (CUI Assets, Out-of-Scope Assets).