Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 201:

  An OSC has two business locations. At each location, the OSC has a wireless guest network to which non-OSC employees are allowed access. The guest network is not password protected and it connects devices within the local OSC's LAN.

  Based on this information, does the OSC meet the requirements of Level 2 for network access restriction?

  A. No, the OSC needs to go through an additional assessment.
  B. No, the OSC has not met the network access restriction requirements.
  C. Yes, there are no network access restriction requirements.
  D. Yes, the OSC has met the network access restriction requirements.
  B. No, the OSC has not met the network access restriction requirements.

  ---

  Explanation

  CMMC Level 2 requires that network access to CUI systems be restricted to authorized users and devices.

  A guest network without password protection that connects directly into the LAN violates AC.L2-3.1.3 (Access Enforcement) and SC.L2-3.13.16 (Cryptographic protection) because unauthorized users may access OSC systems and CUI indirectly.

  Exact Extracts:

  AC.L2-3.1.3: "Control the flow of CUI by enforcing access restrictions." SC.L2-3.13.16: "Employ cryptographic mechanisms to protect confidentiality of CUI during transmission."

  Assessment Guide: "Guest wireless networks must be segmented and controlled to prevent unauthorized access to internal networks containing CUI."

  Why other options are not correct:

  Option A: Additional assessment is irrelevant - issue is failure to meet requirements.

  Option C/D: False - requirements clearly exist, and the OSC's current setup fails them.

• Question 202:

  As the Lead Assessor, you determine that some details, like wireless entry points, are not included in the assessment scope. However, the OSC Assessment Official claims that this is covered in the network enclave. Examining their enclave architecture, you determine it is not covered, but the OSC Assessment Official insists.

  What should you do?

  A. Try to resolve the disagreement before the assessment starts.
  B. Demand the OSC nominates another Assessment Official.
  C. Give in to the OSC Assessment Official's demands.
  D. Report the OSC Assessment Official to the CMMC Accreditation Body.
  A. Try to resolve the disagreement before the assessment starts.

• Question 203:

  During a CMMC assessment, the Lead Assessor discovers that the OSC has outsourced its incident response to a third-party provider. The OSC provides a contract with the provider but no detailed evidence of the provider's processes.

  What should the Lead Assessor do?

  A. Accept the contract as sufficient evidence of incident response compliance.
  B. Request detailed evidence from the third-party provider demonstrating how they meet the CMMC incident response practice objectives.
  C. Score the incident response practice as "NOT MET" due to insufficient evidence.
  D. Terminate the assessment until the OSC implements incident response internally.
  B. Request detailed evidence from the third-party provider demonstrating how they meet the CMMC incident response practice objectives.

• Question 204:

  An OSC has an established password policy. The OSC wants to improve its password protection security by implementing a single change.

  Which of the following is an acceptable element to add to the OSC's password policy?

  A. Require passwords to be changed every 18 months.
  B. Require passwords to be 5 to 7 characters long.
  C. Add the use of salted two-way cryptographic hashes of passwords.
  D. Add the use of salted one-way cryptographic hashes of passwords, where possible.
  D. Add the use of salted one-way cryptographic hashes of passwords, where possible.

  ---

  Explanation

  The Identification and Authentication (IA) practices require that passwords be protected using strong methods. Storing passwords with salted one-way hashes ensures they cannot be reversed, providing strong protection.

  Extract from IA.L2-3.5.10: "Passwords must be stored and transmitted in a form that is resistant to compromise, typically using salted one-way cryptographic hashes."

  Options A and B do not align with modern password guidance, and option C (two-way cryptographic hashing) is insecure because it allows reversal.

  References:

  CMMC Assessment Guide - Level 2, IA.L2-3.5.10.

• Question 205:

  The Lead Assessor is ready to complete planning by developing the assessment schedule. The Lead Assessor and the OSC Assessment Official discuss the Assessment Team members.

  What MUST be submitted to the Cyber-AB before the assessment?

  A. Individual travel plans
  B. Non-disclosure agreements
  C. Verified NIST SP 800-171 assessor qualifications
  D. Absence of Conflict of Interest and Confirmation Statement
  D. Absence of Conflict of Interest and Confirmation Statement

  ---

  Explanation

  The CAP requires that prior to the assessment, the Lead Assessor submit documentation confirming that Assessment Team members have no conflicts of interest and meet qualification requirements. This is recorded through the Absence of Conflict of Interest and Confirmation Statement.

  Extract:

  "Before assessment initiation, the C3PAO must provide confirmation to the Cyber-AB that all Assessment Team members have declared absence of conflict of interest and are confirmed to participate."

  Thus, the required submission is the Absence of Conflict of Interest and Confirmation Statement.

• Question 206:

  You are a Certified CMMC Assessor (CCA) working with a small defense contractor who needs a CMMC Level 2 assessment. This is their first CMMC assessment. During your initial meeting with the OSC, they express a desire for a quick assessment to minimize disruption to their daily operations. They also mention their limited budget for the assessment.

  How will you proceed with assessment framing in this scenario?

  A. Determine the Rough-Order-of-Magnitude (ROM), by having the C3PAO work with the OSC Assessment Official to determine an anticipated level-of-effort and associated cost estimate to conduct the CMMC Assessment.
  B. Define the specific systems, data, and processes in scope for the assessment.
  C. Negotiate the cost of the assessment with the OSC.
  D. Discuss the assessment timeline and resource requirements with the OSC.
  A. Determine the Rough-Order-of-Magnitude (ROM), by having the C3PAO work with the OSC Assessment Official to determine an anticipated level-of-effort and associated cost estimate to conduct the CMMC Assessment.

• Question 207:

  An OSC employs guards to protect the manufacturing shop where a magnetic radar-absorbing coating is manufactured. This specific coating is used by the Army for a particular fleet ofunmanned aerial vehicles (UAVs). The facility is under constant surveillance with the help of HD CCTVs. Within the OSC's facilities, there is a Vector Network Analyzer (VNA) that measures the reflection and transmission properties of the coating over a range of frequencies. Guards protect the OSC's anechoic chamber, and anyone entering must use an iris scanner and sign a physical form detailing their name and reason for being there. At the door is a huge sign reading "Authorized Personnel Only."

  Which of the following statements is true about handling the Vector Network Analyzer (VNA) in a CMMC assessment?

  A. The VNA is out of scope for a CMMC assessment.
  B. The VNA should be reviewed in the SSP in accordance with practice CA.L2-3.12.4 - System Security Plan.
  C. The VNA should be assessed against CMMC practices.
  D. If appropriately documented, the assets should not be assessed against other CMMC practices.
  B. The VNA should be reviewed in the SSP in accordance with practice CA.L2-3.12.4 - System Security Plan.

• Question 208:

  During a CMMC assessment, you, as a CCA, are interviewing a key OSC employee with information security responsibilities about the access control procedures. As the interview progresses, you realize that the initial information provided in the System Security Plan (SSP) doesn't fully align with the employee's explanation.

  Based on the scenario and your role as a CCA, what is not one of your responsibilities as an assessment team member?

  A. Interview additional personnel to corroborate the information provided by the POC.
  B. Map the interview findings regarding access control to the relevant CMMC practices.
  C. Inform the OSC management about the potential discrepancy between the SSP and actual practices.
  D. Update the assessment plan to reflect the newly discovered information about access control procedures.
  C. Inform the OSC management about the potential discrepancy between the SSP and actual practices.

• Question 209:

  You have been hired to assess an OSC's implementation of secure password storage and transmission mechanisms. The OSC uses a popular identity and access management (IAM) solution from a reputable vendor to manage user authentication across their systems. During the assessment, you examine the IAM solution's configuration and documentation, which indicate that passwords are hashed using industry-standard algorithms like SHA-256 or bcrypt before being stored in the system's database. Additionally, the IAM solution leverages TLS encryption for all communications, ensuring that passwords are transmitted securely over the network.

  Based on the information provided, how would you assess the OSC's compliance with CMMC practice IA.L2-3.5.10 - Cryptographically-Protected Passwords, which requires organizations to store and transmit only cryptographically protected passwords?

  A. Not Met (-5 points)
  B. Met (+5 points)
  C. Met (+1 point)
  D. Not Met (-1 point)
  B. Met (+5 points)

• Question 210:

  In order to perform an interview, the Lead Assessor MUST ensure interview questions are:

  A. Yes/no questions
  B. Asked by any member of the OSC's team
  C. Asked to those who implement, perform, or support the practices
  D. Asked with multiple people simultaneously to limit the number of interviews needed
  C. Asked to those who implement, perform, or support the practices

  ---

  Explanation

  Applicable Requirement: CAP - Interview Guidance.

  Why Option C is Correct: Interviews must be directed to personnel responsible for implementing, performing, or supporting practices to ensure accurate and objective evidence is collected.

  Why Other Options Are Insufficient:

  Option A: Yes/no questions do not provide sufficient evidence detail.

  Option B: OSC personnel cannot ask themselves assessment questions; only assessors may conduct interviews.

  Option D: Group interviews may be used in some cases, but CAP stresses targeted interviews for evidence reliability.

  References (CCA Official Sources):

  CMMC Assessment Process (CAP) v1.0 - Interview Requirements NIST SP 800-171A - Use of Interview as an Assessment Method