Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 11:

  A CMMC Assessment Team is evaluating an OSC's implementation of RA.L2-3.11.1 - Risk Assessments.

  Upon examining the OSC's Risk Assessment policy, the team learns that the OSC has specified frequencies for assessing risks to organizational operations, assets, and personnel. The results and reviews of risk assessments indicated that assessments are conducted at these defined frequencies.

  For the OSC's risk assessment to be accurate, it must consider all of the following except which factor?

  A. Threats to organizational assets, operations, and personnel that arise from the operation and use of organizational systems
  B. Risk likelihood and impact on organizational assets, personnel, and operations
  C. Risk from external parties
  D. Whether risk can be transferred to a third party
  D. Whether risk can be transferred to a third party

• Question 12:

  During a CMMC assessment, the Lead Assessor requests evidence from the OSC to support their claim that several access control and authentication practices are inherited from their enterprise-level Identity and Access Management (IAM) system. The OSC claims that their parent company manages the IAM system.

  Which of the following types of evidence would be the most appropriate for the OSC to demonstrate these inherited practices?

  A. Documented policies, procedures, and system configurations from the enterprise IAM system, showing how the assessment objectives for the inherited practices are met.
  B. An attestation from a third-party auditor confirming that the parent company's IAM system is compliant with relevant security standards.
  C. Verbal confirmation from the OSC's IT manager that the enterprise IAM system handles accesscontrol and authentication.
  D. A self-assessment report from the OSC stating that the enterprise IAM system meets the inherited practices.
  A. Documented policies, procedures, and system configurations from the enterprise IAM system, showing how the assessment objectives for the inherited practices are met.

• Question 13:

  A Lead Assessor is preparing to conduct a Level 2 Assessment for an OSC. The assessor already determined the assessment scope and systems included. In addition, the assessor requests:

  1. Results of the most recent OSC self-assessment or any pre-assessments by an RPO

  2. The System Security Plan (SSP), and

  3. A list of all OSC staff who play a role in in-scope procedures.

  Based on this information, which item would the assessor MOST LIKELY request when preparing to conduct a Level 2 Assessment?

  A. A list of objectives
  B. A manual for each system
  C. A preliminary list of the anticipated evidence
  D. A list of assets that are determined to be out-of-scope
  C. A preliminary list of the anticipated evidence

  ---

  Explanation

  The CMMC Assessment Process (CAP) requires the Lead Assessor to develop an Assessment Plan that specifies anticipated evidence to be provided by the OSC. This preliminary evidence list ensures that OSC staff understand what policies, procedures, logs, and technical configurations must be available during the assessment. Without this, the assessment may stall due to missing documentation.

  Exact extracts:

  "The Lead Assessor coordinates with the OSC to develop an evidence list of artifacts anticipated for review." "The assessment plan must include a schedule of interviews, site visits, and anticipated evidence." "Preliminary evidence identification is critical to reduce assessment delays and ensure assessor readiness." Expanded explanation: This step bridges planning and execution:

  1. Scope has already been set.

  2. Now, the evidence (SSPs, policies, audit logs, diagrams, etc.) must be identified.

  3. Out-of-scope assets are part of scoping, not this planning stage.

  4. System manuals are not required by CMMC, and "list of objectives" refers to assessor methodology, not

  OSC preparation.

  Why other options are incorrect:

  Option A: Objectives come from the practice requirements themselves, not something requested from the

  OSC.

  Option B: System manuals are not required artifacts for CMMC.

  Option D: Out-of-scope assets were already determined during scoping.

  References:

  CMMC Assessment Process (CAP) - Evidence planning and assessment preparation.

  CCA Study Guide - Pre-assessment coordination.

• Question 14:

  An OSC plans to bid for a DoD contract to supply laser welding services to repair a fleet of unmanned aerial vehicles (UAVs). This requires them to be CMMC Level 2 certified since the information they will receive from the DoD is Controlled Technical Information (CTI). However,their repair and welding services require a Computer Numerical Control (CNC) machine to fabricate some crucial parts. Since the welding is mainly automated using robots, the OSC has intelligently integrated its SCADA system with Programmable Logic Controllers (PLCs) for increased accuracy, improved safety and efficiency, and enhanced flexibility.

  As the Lead Assessor for the C3PAO Assessment Team validating the OSC's CMMC assessment scope, you expect the OSC to handle the SCADA system, PLCs, and CNC machines in all the following ways EXCEPT?

  A. Categorize them as CUI assets.
  B. Document these assets in the SSP to show they are managed using the OSC's risk-based security policies, procedures, and practices.
  C. Provide a network diagram of the assessment scope (to include these assets) to facilitate scoping discussions during the pre-assessment.
  D. Document these assets in the asset inventory.
  A. Categorize them as CUI assets.

• Question 15:

  A company employs an encrypted VPN to enhance confidentiality over remote connections. The CCA reads a document describing the VPN. It states the VPN allows automated monitoring and control of remote access sessions, helps detect cyberattacks, and supports auditing of remote access to ensure compliance with CMMC requirements.

  What document is the CCA MOST LIKELY reviewing to see how these VPNs are controlled and monitored?

  A. Access Control Policy
  B. Media Protection Policy
  C. Audit and Accountability Policy
  D. Configuration Management Policy
  A. Access Control Policy

  ---

  Explanation

  The Access Control (AC) domain governs remote access, privileged access, and VPN controls.

  Documents describing how VPNs are controlled, monitored, and restricted fall under the Access Control Policy.

  Extract:

  "Access Control practices include the management of remote connections, monitoring of sessions, and enforcement of VPN controls."

  Thus, the correct document is the Access Control Policy.

  CMMC Assessment Guide - Level 2, AC.L2-3.1.x.

• Question 16:

  CMMC practice SC.L2-3.13.6 assessment objectives [a] and [b] require contractors' systems to deny network communications traffic by default [a] and allow network communications traffic by exception [b] respectively. As a CCA, you assess whether an OSC has segmented its network into different zones. The OSC has implemented Access Control Lists (ACLs) on its network devices to permit or deny traffic based on source and destination IP addresses and ports. Additionally, the OSC uses a Fortinet Next-Generation Firewall (NGFW). To monitor their computing environment, theOSC uses a state-of-the-art SIEM.

  Which of the following assessment methods is NOT a method you would use to assess whether the OSC has met assessment objectives [a] and [b]?

  A. Examine the ACL configurations on the network devices
  B. Observe the SIEM monitoring and logging capabilities
  C. Interview the system administrators about the organization's network segmentation strategy
  D. Analyze the firewall rules and policy settings on the NGFW
  B. Observe the SIEM monitoring and logging capabilities

• Question 17:

  While examining a contractor's audit and accountability policy, you realize they have documented types of events to be logged and defined content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activities. After the logs are analyzed, the results are fed into a system that automatically generates audit records stored for 30 days. However, mechanisms implementing system audit logging are lacking after several tests because they produce audit logs that are too limited. You find that generated logs cannot be independently used to identify the event they resulted from because the defined content specified therein is too limited. Additionally, you realize the logs are retained for 24 hours before they are automatically deleted.

  Which of the following is a potential assessment method for AU.L2- 3.3.1 - System Auditing?

  A. Examine procedures addressing audit record generation
  B. Testing procedures addressing control of audit records
  C. Testing the system configuration settings and associated documentation
  D. Examining the mechanisms for implementing system audit logging
  A. Examine procedures addressing audit record generation

• Question 18:

  An organization's password policy includes these requirements:

  1. Passwords must be at least 8 characters in length.

  2. Passwords must contain at least one uppercase character, one lowercase character, and one numeric digit.

  3. Passwords must be changed at least every 90 days.

  4. When a password is changed, none of the previous 3 passwords can be reused.

  Per IA.L2-3.5.7: Password Complexity, what requirement is missing from this password policy?

  A. It does not require MFA.
  B. It does not include a list of prohibited passwords.
  C. It does not specify a minimum change of character requirement.
  D. It does not require the password to contain at least one special character.
  D. It does not require the password to contain at least one special character.

  ---

  Explanation

  IA.L2-3.5.7 requires password complexity rules that include uppercase, lowercase, numeric, and special characters. The given policy addresses three requirements but does not mandate at least one special character.

  Extract:

  "Enforce password complexity by requiring combinations of upper-case letters, lower-case letters, numbers, and special characters."

  Thus, the missing requirement is the use of a special character.

• Question 19:

  You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. During the assessment, you find that the OSC has failed to meet the requirements for CMMC practice AU.L2-3.3.4 - Audit Failure Alerting.

  According to the CMMC Assessment Process (CAP), which of the following should be your next step?

  A. Immediately stop the assessment and report the failure to the C3PAO.
  B. Mark the practice as "NOT MET" in the final assessment report without further action.
  C. Provide the OSC with a specific timeframe to remediate the failed practice.
  D. Evaluate the failed practice against the DoD Assessment Methodology and CMMC 2.0 POA&M scoring criteria.
  D. Evaluate the failed practice against the DoD Assessment Methodology and CMMC 2.0 POA&M scoring criteria.

• Question 20:

  After being selected for a C3PAO Assessment Team, you have been chosen as the Lead Assessor for an upcoming project involving an OSC that produces aircraft parts. Your C3PAO has assigned you various responsibilities.

  Which of the following is not your responsibility as a Lead Assessor?

  A. Validating site access and communicating visitation policies with the Assessment Team.
  B. Framing and planning the assessment.
  C. Developing the evidence collection approach and managing the assessment team.
  D. Review and collect evidence to demonstrate that the practice being performed is effectively implemented and conforms to the CMMC standard.
  D. Review and collect evidence to demonstrate that the practice being performed is effectively implemented and conforms to the CMMC standard.