Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 191:

  You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment.

  What is the primary focus of the `Sufficiency' criterion during the evidence verification process in a CMMC assessment?

  A. Confirming the evidence has been reviewed and approved by all stakeholders.
  B. Sufficiency verifies that there is enough evidence to comprehensively assess each practice against the CMMC Assessment scope.
  C. Checking if the evidence includes the latest cybersecurity trends and technologies.
  D. Ensuring the evidence covers a wide range of cybersecurity threats.
  B. Sufficiency verifies that there is enough evidence to comprehensively assess each practice against the CMMC Assessment scope.

• Question 192:

  In ensuring it meets its mandates to protect CUI under CMMC, a contractor has implemented a robust, dynamic session lock with pattern-hiding displays to prevent access and viewing of data. After every 5 minutes of inactivity, the current session is locked and a blank, black screen with a battery life indicator is displayed.

  As a CCA, you will potentially use the following assessment methods to examine the contractor's implementation of session lock EXCEPT?

  A. Interview the system administrator
  B. Examine the system design documentation
  C. Test the strength of the user's password
  D. Test the mechanisms implementing the access control policy for session lock
  C. Test the strength of the user's password

• Question 193:

  Risks are inherent in any organization. As a CCA working within an Assessment Team, you are assessing an OSC's implementation of RA practices. When evaluating RA.L2-3.11.3[b], you want to determine whether vulnerabilities are remediated in accordance with risk assessments.

  What Assessment Object would you likely examine to make this determination?

  A. Patch and vulnerability management records
  B. Vulnerability scanning tools and associated configuration documentation
  C. Vulnerability scanning results
  D. Security Assessment Report
  A. Patch and vulnerability management records

• Question 194:

  Both FCI and CUI are stored by an OSC on the same network. Server A contains file shares with FCI, and Server B contains file shares with CUI. The OSC hopes each server would only undergo the assessment for the classification of data it contains.

  What is the MOST correct assessment situation in this scenario?

  A. Due to the presence of CUI on the network, a Level 2 certification is required for the network
  B. Server A may undergo a Level 1 self-assessment, while Server B must obtain a Level 2 certification
  C. Due to the presence of FCI on the network, only a Level 1 self-assessment is required for the network
  D. The network must be segmented to separate FCI from CUI before any assessments can be conducted
  A. Due to the presence of CUI on the network, a Level 2 certification is required for the network

  ---

  Explanation

  When CUI and FCI reside on the same network, the entire environment is considered a CUI environment.

  The presence of CUI drives the assessment requirement to CMMC Level 2, regardless of whether FCI also exists. Assets cannot be assessed separately under Level 1 vs. Level 2 within the same network boundary.

  Exact extracts:

  "If CUI is processed, stored, or transmitted within an environment, the environment is in scope for CMMC Level 2." "The presence of CUI dictates the assessment level, regardless of whether FCI is also present." "Segmentation may reduce scope, but if assets remain within the same environment, all assets fall under Level 2."

  Why other options are incorrect:

  Option B: Level 1 cannot be applied to Server A while Server B undergoes Level 2 in the same network.

  Option C: Presence of CUI means Level 2 is required, not Level 1.

  Option D: Segmentation can reduce scope but is not required before assessment; it is an OSC design choice.

  References:

  CMMC Scoping Guide - Level 2 (FCI vs.CUI environments).

  CMMC Assessment Guide - Applicability of Level 1 vs.Level 2.

• Question 195:

  An OSC seeking Level 2 certification wants to develop and launch a website for customers to purchase items online and submit contact forms. The OSC plans to host the web server in their own data center while also maintaining the security of their internal IT environment.

  Based on this information, what would be the BEST approach?

  A. Relocate the server to a different office location to protect the OSC's LAN
  B. Configure a DMZ for an additional layer of security to the OSC's LAN to host the publicly accessible server
  C. Configure a firewall rule to only allow internal traffic to communicate with the server for an additional layer of security to the OSC's LAN
  D. Configure the server to protect against object reuse and residual information via shared system resources for an additional layer of security to the OSC's LAN
  B. Configure a DMZ for an additional layer of security to the OSC's LAN to host the publicly accessible server

  ---

  Explanation

  Public-facing systems (such as web servers) must be separated from internal enterprise networks to limit exposure. CMMC (aligned with NIST SP 800-171 SC.L2-3.13.5 "Boundary Protection") specifies that placing public servers into a demilitarized zone (DMZ) provides a security buffer and prevents direct access from the internet into the internal LAN.

  Exact extracts:

  "Publicly accessible systems should be placed on separate subnets or in DMZs." "Boundary protection devices should separate public servers from the enterprise network." "DMZs provide layered protection for internet-facing assets."

  Why the other options are incorrect:

  Option A: Relocating the server physically does not provide network-layer security.

  Option C: Firewall rules allowing only internal traffic would prevent public access, defeating the purpose of a public website.

  Option D: Object reuse protections are unrelated to network boundary security.

  References:

  CMMC Assessment Guide - Level 2, SC.L2-3.13.5 "Boundary Protection."

  NIST SP 800-171 Rev. 2, 3.13.5.

• Question 196:

  A CCA is asked to validate if an OSC has separated their systems containing CUI from other departments' systems on their local network.

  Which of the following MUST the CCA assess?

  A. Area Network (WAN)
  B. Virtual Private Network (VPN)
  C. Virtual Local Area Network (VLAN)
  D. Network Address Translation (NAT)
  C. Virtual Local Area Network (VLAN)

  ---

  Explanation

  To validate separation of CUI systems from non-CUI systems on a local network, the assessor must evaluate the VLAN configuration. VLANs are a recognized logical segmentation method for separating enclaves, as defined in the CMMC Scoping Guide.

  Exact Extracts:

  CMMC Scoping Guide: "Isolation can be achieved by implementing subnetworks with firewalls, routers, and VLANs to ensure separation of CUI assets from out-of-scope assets." "CUI Assets must be isolated from non-CUI assets unless those non-CUI assets are designated as Security Protection Assets or Contractor Risk Managed Assets."

  Why other options are not correct:

  Option A (WAN): Wide Area Networks describe external connectivity, not local separation.

  Option B (VPN): VPN provides encrypted remote access but does not enforce local network segmentation.

  Option D (NAT): NAT provides IP translation, not logical separation of traffic.

  References:

  CMMC Assessment Scope - Level 2, Version 2.13: Isolation requirements and VLAN as an example (pp.9-

  11. .

  CMMC Assessment Guide - Level 2: Assessor validation of enclave boundary methods.

• Question 197:

  You decide to interview the IT security team to understand if and how a contractor has implemented audit failure alerting. You learn they have deployed AlienVault OSSIM, a feature-rich security information and event management (SIEM) tool. The SIEM tool has been configured to send automatic alerts to system and network administrators if an event affects the audit logging process. Alerts are generated for the defined events that lead to failure in audit logging and can be found in the notification section of the SIEM portal. However, the alerts are sent to the specified personnel 24 hours after the occurrence of an event.

  As an assessor evaluating the implementation of AU.L2-3.3.4 - Audit Failure Alerting, which of the following would be a key consideration regarding theevidence provided by the contractor?

  A. Ensuring the defined alert notification methods (e.g., email, SMS) are secure and encrypted
  B. Verifying that the types of audit logging failures defined cover a comprehensive range of potential scenarios
  C. Determining if the documented personnel roles for alert notification align with the organization's hierarchy
  D. Checking if the alert notification process integrates with third-party monitoring services
  B. Verifying that the types of audit logging failures defined cover a comprehensive range of potential scenarios

• Question 198:

  As a CCA on a C3PAO Assessment Team, you have determined that the assessment scope provided by an OSC indicates plans to subcontract some elements of their contract to DelTech Inc. The OSC plans to bid on a DoD contract to develop guidance and targeting software. However, the software needs testing after installing a new surface-to-air defense system. Unfortunately, the OSC lacks themeans to test the software, which is where DelTech comes in.

  As a CCA, what must you do in this scenario?

  A. Inform the OSC that they cannot subcontract
  B. Assess DelTech Inc.'s CMMC compliance status
  C. Continue assessing the OSC's implementation of the CMMC practices
  D. Confirm that the OSC has flowdown requirements in their subcontract with DelTech Inc. and that DelTech is CMMC Certified at a level commensurate with the risk of information they will handle
  D. Confirm that the OSC has flowdown requirements in their subcontract with DelTech Inc. and that DelTech is CMMC Certified at a level commensurate with the risk of information they will handle

• Question 199:

  As part of a C3PAO Assessment Team, you are reviewing an OSC's security practices and documentation. During your review, you notice that the OSC has presented the same evidence artifacts to support its implementation of several CMMC practices and objectives.

  Based on the scenario above and your understanding of the CMMC Assessment process, which of the following is true?

  A. The same evidence artifacts can be used for practices across multiple CMMC domains, but not for assessment objectives.
  B. Each CMMC domain or assessment objective requires a unique set of evidence artifacts.
  C. The same evidence artifacts can be used for practices across multiple CMMC domains or assessment objectives.
  D. A POA&M can be used in place of evidence.
  C. The same evidence artifacts can be used for practices across multiple CMMC domains or assessment objectives.

• Question 200:

  Video monitoring is used by an OSC to help meet PE.L2-3.10.2: Monitor Facility. The OSC's building has three external doors, each with badge access and a network-connected video camera above the door. The video cameras are connected to the same network as employee computers. The OSC contracted a local security company to provide surveillance services. The security company stores the recordings at its premises and requires access to the OSC's network to manage the video cameras.

  Which factor is a clear negative finding for the OSC's assessment?

  A. Video surveillance needs to be of both private and public areas of the building
  B. A non-certified third party accesses the OSC's network to manage the cameras
  C. Video surveillance alone does not satisfy the facility monitoring requirement of PE.L2-3.10.2
  D. A non-certified third party's data center may not store video recordings for a company authorized to process CUI
  B. A non-certified third party accesses the OSC's network to manage the cameras

  ---

  Explanation

  The negative finding is that the OSC permits an uncertified external security provider to access the OSC's internal network. This introduces unmanaged risk to the CUI environment. CMMC requires the OSC to control and monitor external service provider access. The storage of recordings externally is not inherently noncompliant if properly controlled, and video monitoring is a valid method of meeting PE.L2-3.10.2. The key failure is giving unmanaged third-party access.

  Exact extracts:

  "Monitor physical facility to detect and respond to physical security incidents." (PE.L2-3.10.2) "Assessment Objectives... Determine if: monitoring is performed; unauthorized physical access is detected and responded to." "External service providers that connect into the OSC network are considered in-scope and must meet CMMC requirements or have equivalent authorization (e.g., FedRAMP)."

  Why other options are incorrect:

  Option A: Requirement does not mandate monitoring of both public and private areas.

  Option C: Video surveillance is an acceptable facility monitoring method when properly implemented.

  Option D: External storage can be acceptable if contractual safeguards and compliance are in place.

  References:

  CMMC Assessment Guide - Level 2, PE.L2-3.10.2.

  CMMC Scoping Guide - External Service Providers.