Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 191:

  While assessing the scope provided by an OSC, you realize they have two environments with distinct characteristics: the headquarters space located at 24 Industrial Pkwy and an off-site location at 25 Industrial Pkwy. The headquarters houses several offices where document processing occurs on a cloud-hosted Microsoft Dynamics 365 GCC environment. At the off-site location, users access designs from servers hosted at the headquarters through a Virtual Private Network (VPN). These designs are used first in a 3D printer to develop prototypes and subsequently in a Computer Numerical Control (CNC) machine for production. All these operations are supported by a high-quality Industrial Control System (ICS). What type of environment is the off-site facility located at 25 Industrial Pkwy?

  A. Backup environment
  B. Professional environment
  C. Industrial environment
  D. Off-site environment
  C. Industrial environment

• Question 192:

  A contractor allows for the use of mobile devices in contract performance. Some employees access designs and specifications classified as CUI on such devices like tablets and smartphones. After assessing AC.L2-3.1.18 ?Mobile Device Connection, you find that the contractor maintains a meticulous record of mobile devices that connect to its information systems. AC.L2-3.1.19 ?Encrypt CUI on Mobile, requires that the contractor implements measures to encrypt CUI on mobile devices and mobile computing platforms. The contractor uses device-based encryption where all the data on a mobile device is encrypted. Which of the following personnel should you interview to determine how well the contractor has implemented AC.L2-3.1.19 ?Encrypt CUI on Mobile?

  A. Executives in the company
  B. Personnel with access control responsibilities for mobile devices
  C. IT helpdesk staff who troubleshoot basic mobile device issues
  D. Staff in the Human Resources department
  B. Personnel with access control responsibilities for mobile devices

• Question 193:

  An OSC employs guards to protect the manufacturing shop where the magnetic radar- absorbing coating is manufactured. The Army uses this specific coating for a particular fleet of unmanned aerial vehicles (UAVs). The facility is under constant surveillance with the help of HD CCTVs. Within the OSC's facilities is a Vector Network Analyzer (VNA) that measures the reflection and transmission properties of the coating over a range of frequencies. Guards protect the OSC's anechoic chamber, and anyone entering must use an iris scanner and sign a physical form detailing their name and reason for being there. At the door is a huge sign reading "Authorized Personnel Only." The OSC has implemented the following physical separation methods to secure its facilities, EXCEPT?

  A. Signage
  B. Monitoring
  C. Biometric locks
  D. Guards
  B. Monitoring

• Question 194:

  You are working as a CCA on a Level 2 Assessment for a DoD prime contractor. The Organization Seeking Certification (OSC) seeks to keep assessment costs down, and the C3PAO and OSC have decided to conduct all possible work remotely. You are assigned to work primarily on the Media Protection (MP), Personnel Security (PS), and Physical Protection (PE) domains. In addition, the Lead Assessor has designated you as the one person from the Assessment Team to conduct all the on-premises work. Which of the following factors do you and the Assessment Team not need to consider as part of your on- site work?

  A. For the virtual aspects of the assessment, availability of a DoD-approved collaboration tool for virtual communication with the OSC
  B. Limitations of conducting on-premises assessments for the Media Protection (MP), Personnel Security (PS), and Physical Protection (PE) domains
  C. For the virtual aspects of the assessment, the mandatory Virtual Assessment Evidence Preparation Template must be used to ensure proper assessment methods
  D. Non-critical areas of the OSC facilities
  D. Non-critical areas of the OSC facilities

• Question 195:

  You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment. What is the primary focus of the `Sufficiency' criterion during the evidence verification process in a CMMC assessment?

  A. Confirming the evidence has been reviewed and approved by all stakeholders.
  B. Sufficiency verifies that there is enough evidence to comprehensively assess each practice against the CMMC Assessment scope.
  C. Checking if the evidence includes the latest cybersecurity trends and technologies.
  D. Ensuring the evidence covers a wide range of cybersecurity threats.
  B. Sufficiency verifies that there is enough evidence to comprehensively assess each practice against the CMMC Assessment scope.

• Question 196:

  During a CMMC assessment, an OSC employee tells the CCA that they don't follow a documented procedure because "it's outdated," but they have an informal process that works better. The informal process appears to meet the practice's objectives. How should the CCA proceed?

  A. Accept the informal process as evidence and score the practice as "MET."
  B. Document the discrepancy between the documented procedure and the informal process as an evidence gap and assess based on all evidence.
  C. Score the practice as "NOT MET" because the documented procedure is not followed.
  D. Request the OSC to update the documented procedure to reflect the informal process.
  B. Document the discrepancy between the documented procedure and the informal process as an evidence gap and assess based on all evidence.

• Question 197:

  An OSC has contacted your C3PAO organization for a prospective CMMC Level 2 assessment. You have been selected to lead the Assessment Team. When ascertaining the assessment conditions and requirements, you discuss the prospective CMMC assessment scope with the OSC. Before proceeding to Phase 2 of the CMMC assessment process, the OSC must complete the following steps of its high-level scoping process, EXCEPT?

  A. Identify and take inventory of the various categories of CMMC assets contained in the networked environment.
  B. Propose the scope of the CMMC assessment that will be evaluated by the Lead Assessor and validated by the C3PAO.
  C. Establish the CMMC Assessment Scope of their networked environment.
  D. Evaluate Model Non-Duplication.
  D. Evaluate Model Non-Duplication.

• Question 198:

  AC.L1-3.1.2 requires OSCs to "limit information system access to the types of transactions and functions that authorized users are permitted to execute." Assessment Objective [a] of AC.L1-3.1.2 requires the Assessor to determine whether "the types of transactions and functions that authorized users are permitted to execute are defined." What assessment method would you use to determine whether the OSC has met this assessment objective?

  A. Interview system developers
  B. Test the system configuration settings
  C. Review the System Security Plan
  D. Examine the list of approved authorizations, including remote access authorizations
  D. Examine the list of approved authorizations, including remote access authorizations

• Question 199:

  During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team. Can the Lead Assessor proceed with the assessment using a reduced assessment team size?

  A. Yes, as long as the remaining team members possess the necessary qualifications to cover all CMMC practices.
  B. Yes, but only with the express written consent of the Cyber AB.
  C. The decision is solely up to the OSC.
  D. No, the assessment must be postponed until the full team is available.
  A. Yes, as long as the remaining team members possess the necessary qualifications to cover all CMMC practices.

• Question 200:

  During a social event after work, a CCA from your C3PAO team brags about providing "consulting advice" to an OSC they recently assessed for CMMC compliance. You know this directly violates the CoPC's restrictions on CCAs offering such services during an assessment. What is your ethical obligation in this situation?

  A. Publicly confront the CCA and remind them of the CoPC violation.
  B. Discreetly approach the CCA and offer to help them understand the CoPC guidelines.
  C. Immediately report the incident to the Cyber AB.
  D. Ignore the situation, as it doesn't involve you directly.
  B. Discreetly approach the CCA and offer to help them understand the CoPC guidelines.