Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 201:

  A CCA is conducting a CMMC assessment and notices that the OSC's evidence includes screenshots of system configurations that are not dated. The OSC claims the screenshots are current. How should the CCA proceed?

  A. Accept the screenshots as evidence since the OSC claims they are current.
  B. Document the lack of dates as an evidence gap and request additional verification of currency.
  C. Reject the screenshots and score the related practice as "NOT MET."
  D. Ask the OSC to recreate the screenshots with current dates during the assessment.
  B. Document the lack of dates as an evidence gap and request additional verification of currency.

• Question 202:

  As part of a C3PAO Assessment Team, you are reviewing an OSC's security practices and documentation. During your review, you notice that the OSC has presented the same evidence artifacts to support its implementation of several CMMC practices and objectives. Based on the scenario above and your understanding of the CMMC Assessment process, which of the following is true?

  A. The same evidence artifacts can be used for practices across multiple CMMC domains, but not for assessment objectives.
  B. Each CMMC domain or assessment objective requires a unique set of evidence artifacts.
  C. The same evidence artifacts can be used for practices across multiple CMMC domains or assessment objectives.
  D. A POAandM can be used in place of evidence.
  C. The same evidence artifacts can be used for practices across multiple CMMC domains or assessment objectives.

• Question 203:

  During a CMMC assessment, the OSC provides a policy document that is signed by a manager who left the company six months ago. The OSC insists the policy is still enforced, and staff interviews confirm its use. How should the Lead Assessor proceed?

  A. Accept the policy as valid evidence since it is still enforced.
  B. Document the outdated signature as an evidence gap and assess the policy's implementation based on interviews and other evidence.
  C. Reject the policy due to the outdated signature and score the practice as "NOT MET."
  D. Request the OSC to obtain a new signature from current management before proceeding.
  B. Document the outdated signature as an evidence gap and assess the policy's implementation based on interviews and other evidence.

• Question 204:

  Jane is a CCA leading a CMMC assessment for an OSC. During the evaluation, Jane discovers that the OSC's Chief Information Security Officer (CISO) is a former colleague with whom she had a contentious relationship in the past. Unbeknownst to the OSC, Jane still harbors resentment toward the CISO due to their previous conflicts. As the assessment progresses, Jane becomes increasingly critical of the CISO's security practices, scrutinizing every detail and finding fault despite the OSC's best efforts to demonstrate compliance. Given this scenario, how can a Certified CMMC Assessor's personal bias impact the assessment of the OSC?

  A. Assessor bias has no effect on the assessment process and outcomes
  B. Assessor bias is not a concern in CMMC assessments
  C. Personal bias may result in an unfairly harsh and critical assessment of the OSC
  D. Assessor bias can lead to an overly lenient evaluation of the OSC
  C. Personal bias may result in an unfairly harsh and critical assessment of the OSC

• Question 205:

  During scoping discussions with a Lead Assessor, the OSC mentions that there are several connected systems within the organization's network. How should the Lead Assessor consider connected systems in the scoping of the CMMC assessment?

  A. Connected systems are never in scope unless specifically requested by the OSC.
  B. Connected systems are only in scope if they directly transmit FCI and/or CUI.
  C. Only internally connected systems directly handling FCI and/or CUI are in scope.
  D. Connected systems would be considered in scope for the assessment if the systems could impact the security of the CUI (or FCI) environment or if they store, process, or transmit CUI (or FCI) within the organization's network.
  D. Connected systems would be considered in scope for the assessment if the systems could impact the security of the CUI (or FCI) environment or if they store, process, or transmit CUI (or FCI) within the organization's network.

• Question 206:

  As the Lead Assessor conducting a CMMC Level 2 assessment for an OSC, the Assessment Team has thoroughly reviewed all evidence provided by the OSC for the in- scope CMMC practices. Throughout the assessment process, daily checkpoint meetings were held with the OSC to allow them to present additional evidence and clarify any concerns. After the final evidence review and discussions, the Team has determined that 92 out of the 110 CMMC Level 2 practices have been scored as `MET.' Additionally, 18 practices have been scored as `NOT MET,' with 5 of those practices deemed ineligible for a Plan of Action and Milestones (POAandM) due to their potential impact on network exploitation or CUI exfiltration. The OSC has provided a draft POAandM for the remaining 13 `NOT MET' practices, outlining their proposed remediation actions and timelines. In reviewing the OSC's draft POAandM, you notice that one of the proposed remediation actions involves implementing a new security control that could potentially impact the effectiveness of another practice that was scored as `MET.' How should you proceed?

  A. Note the concern but allow the POAandM to proceed, as the impact on other practices can be reassessed during the next CMMC assessment.
  B. Accept the POAandM as it is, provided that the proposed remediation timelines are reasonable.
  C. Request the OSC to revise the POAandM, removing any actions that could limit the effectiveness of practices scored as `MET.'
  D. Reject the entire POAandM and require the OSC to resubmit it with all necessary corrections.
  C. Request the OSC to revise the POAandM, removing any actions that could limit the effectiveness of practices scored as `MET.'

• Question 207:

  When assessing an OSC's compliance with IR requirements, you realize they have deployed a system that tracks incidents, documents details, and updates the status throughout the incident response process. Personnel to whom incidents must be reported are identified and designated. While examining their documentation, you come across an incident response template that they use to capture all relevant information and ensure consistency in reporting to the identified authorities and organizational officials. Interviewing the IR team, you learn there is an escalation process that the contractor's cybersecurity team can use to address more serious incidents. From the scenario, the contractor has met all the required objectives for CMMC practice IR.L2-3.6.2 ?Incident Reporting, meaning its implementation of the said practice will be scored MET with a total of 5 points. For how long must the OSC retain the incident records?

  A. 72 hours
  B. 90 days
  C. 90 hours
  D. 72 days
  B. 90 days

• Question 208:

  You are a CCA working for a well-known C3PAO. You have been selected for an Assessment Team tasked with conducting a CMMC assessment on a C3PAO. While you are reviewing the presented evidence, one of the Assessment Team members informs you that they weren't trained for the job and that a friend helped them get the position. By employing non-credentialed individuals and assigning them assessment tasks, which requirement of the CoPC has the C3PAO violated?

  A. Integrity
  B. None; it is well within their rights to hire whomever they want.
  C. Confidentiality
  D. Professionalism
  D. Professionalism

• Question 209:

  When discussing the OSC's proposed assessment scope, the Lead Assessor learned that some laptops and workstations share a network with CUI assets, but their users do not work with CUI. These assets do not store CUI or run applications that process CUI. Reviewing the OSC's SSP, the implemented risk-based security policies, procedures, and practices raised questions and were found to be deficient. What can the Lead Assessor do in this scenario?

  A. Inform the C3PAO so as to obtain advice on the way forward.
  B. Advise the OSC PoC or Assessment Official to address the identified deficiencies.
  C. Conduct a limited spot check to identify risks.
  D. Validate the scope because the assets do not interact with CUI.
  C. Conduct a limited spot check to identify risks.

• Question 210:

  An OSC is looking to bid for a contract to manufacture turboprop engines for an unmanned aerial vehicle (UAV) fleet used by the Army for long-range reconnaissance. To manage production, the OSC will use Industrial Control Systems (ICS) and has documented them in its Operational Technology (OT) inventory. While validating the OSC's proposed assessment scope, the Assessment Team reviews their SSP. How should the C3PAO Assessment Team handle the OSC's OT during the assessment?

  A. Accept the OSC's documentation of policies and procedures as they are.
  B. Assess them against CA.L2-3.12.3 - Security Control Monitoring.
  C. Assess them against all CMMC practices.
  D. Review the SSP and not assess the OT against other CMMC practices.
  D. Review the SSP and not assess the OT against other CMMC practices.