Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 221:

  A vulnerability scan on a defense contractor's system identifies a critical security flaw in a legacy database application that stores CUI. Remediating the flaw would require a complete overhaul of the application, causing significant downtime and potentially disrupting critical business functions. Given the potential consequences of remediation, the contractor is considering deferring the fix.

  Which course of action best aligns with the guidance of CMMC practice RA.L2-3.11.3 - Vulnerability Remediation?

  A. Immediately contract a third party to assist with remediation
  B. Document the risk acceptance rationale and continue monitoring the risk from the vulnerability
  C. Permanently disregard the vulnerability and take no further action
  D. Implement compensating controls to reduce the associated risk
  B. Document the risk acceptance rationale and continue monitoring the risk from the vulnerability

• Question 222:

  Upon examining a contractor's security and awareness training policy for compliance with AT.L2-3.2.2 - Role-Based Training, you determine that they offer their employees training on handling CUI securely.

  However, system auditors, system administrators, penetration testers, and other cybersecurity roles are all provided biannual training on CUI handling and cybersecurity best practices.

  How would you assess the contractor's implementation of CMMC practice AT.L2-3.2.2 - Role-Based Training?

  A. Not Met
  B. Partially Met
  C. Not Applicable
  D. Met
  A. Not Met

• Question 223:

  Documentation is a key aspect of the CMMC assessment. When preparing for a prospective assessment and during the actual CMMC assessment, you will reference various documents and document various findings. Fortunately, you can download some of these documents from the DoD CIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC's preparedness and readiness for a CMMC assessment.

  Where would you document the OSC's readiness to proceed to the second phase of the CMMC Assessment Process (CAP)?

  A. In the CMMC Assessment Results.
  B. In the CMMC Assessment Quality Review Checklist.
  C. In the CMMC Assessment Readiness Review (CA-RR) Checklist.
  D. In the CMMC Assessment Findings Briefing.
  C. In the CMMC Assessment Readiness Review (CA-RR) Checklist.

• Question 224:

  A software development company uses a cloud-based source code repository and continuous integration/ continuous deployment (CI/CD) platform to manage its software development lifecycle. The cloud service provider hosts and manages the source code repository and CI/CD platform.

  Which of the following statements accurately describes how the OSC should handle the cloud service provider's assets in the CMMC Assessment Scope?

  A. Exclude the cloud provider's assets from the Assessment Scope since they are not owned or managed by the company.
  B. Include the cloud provider's assets in the Assessment Scope as they handle sensitive code.
  C. Include the cloud service provider's assets in the certification boundary but exclude them from the assessment scope.
  D. It depends on the contract between the company and the cloud provider.
  B. Include the cloud provider's assets in the Assessment Scope as they handle sensitive code.

• Question 225:

  You are a CCA with an active and good standing on the Cyber AB Marketplace. An OSC has contracted your C3PAO for a prospective CMMC Assessment. The OSC provides signal processing services for the DoD. You assisted the OSC in preparing for the upcoming CMMC assessment by conducting an initial evaluation of their implementation practices. With your background in cybersecurity and extensive experience, your C3PAO and Lead Assessor have selected you to join the Assessment Team.

  Based on this scenario, which of the following is the most important factor for the C3PAO to consider when assigning assessors to the Assessment Team?

  A. The Assessor's active status and good standing as a CMMC Certified Assessor or Professional, verified on the Cyber AB Marketplace, are important factors.
  B. The Assessor's hourly rate, especially for independent assessors.
  C. The Assessor's professional reputation within the CMMC ecosystem.
  D. The Assessor's specialization with the OSC's lines of business or industry sub-sector.
  A. The Assessor's active status and good standing as a CMMC Certified Assessor or Professional, verified on the Cyber AB Marketplace, are important factors.

• Question 226:

  During a CMMC assessment, the Lead Assessor requests evidence from the OSC to support their claim that several access control and authentication practices are inherited from their enterprise-level Identity and Access Management (IAM) system. The OSC claims that their parent company manages the IAM system.

  Which of the following types of evidence would be the most appropriatefor the OSC to demonstrate these inherited practices?

  A. Documented policies, procedures, and system configurations from the enterprise IAM system, showing how the assessment objectives for the inherited practices are met.
  B. An attestation from a third-party auditor confirming that the parent company's IAM system is compliant with relevant security standards.
  C. Verbal confirmation from the OSC's IT manager that the enterprise IAM system handles access control and authentication.
  D. A self-assessment report from the OSC stating that the enterprise IAM system meets the inherited practices.
  A. Documented policies, procedures, and system configurations from the enterprise IAM system, showing how the assessment objectives for the inherited practices are met.

• Question 227:

  You are a Lead Assessor working with your C3PAO to conduct a CMMC Assessment for an OSC. During the preparation and planning phase, you meet with the OSC's Assessment Official to identify the resources and schedule for the upcoming assessment. Together, you review the OSC's pre-assessment information to estimate the level of effort required. You then collaborate to determine the specific resources needed, including the Assessment Team members, facilities, and any support personnel from the OSC. You also discuss scheduling factors like duration, key activities, and potential constraints. Based on these discussions, you develop a Rough Order of Magnitude (ROM) cost estimate and a proposed daily schedule for the assessment activities.

  What is your primary responsibility in identifying resources and schedule during Phase 1?

  A. Finalizing the contract agreement between the C3PAO and OSC.
  B. Selecting the assessment team members and their roles.
  C. Determining the overall cost estimate for the assessment.
  D. Verifying that all planning requirements are met when constructing the ROM estimate.
  D. Verifying that all planning requirements are met when constructing the ROM estimate.

• Question 228:

  During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on the OSC's procedures around configuration management and endpoint security. The system administrator described how they build and deploy new systems, and noted that some users require specialized applications for their jobs.

  Users have been asked to email IT when they install and run an additional application so IT can add it to their list of allowed software.

  What must the CCA conclude?

  A. The OSC has properly implemented application deny listing.
  B. The OSC has not properly implemented application allow listing.
  C. IT must deploy an application to report newly installed software.
  D. IT does not have a policy that users notify IT when they install new applications.
  B. The OSC has not properly implemented application allow listing.

  ---

  Explanation

  The CMMC practice CM.L2-3.4.8 - Application Allow Listing requires that only specifically authorized software is permitted to execute, while all other software is automatically denied.

  Extract:

  "Application allow listing requires that only approved, explicitly identified applications are authorized to execute on a system. Reliance on users to notify IT after the fact does not meet the requirement."

  Because the OSC's process depends on users self-reporting rather than enforcing automated allow listing, it is not properly implemented.

  References:

  CMMC Assessment Guide - Level 2, CM.L2-3.4.8 (Configuration Management).

• Question 229:

  An OSC is looking to bid for a contract to manufacture turboprop engines for an unmanned aerial vehicle (UAV) fleet used by the Army for long-range reconnaissance. To manage production, the OSC will use Industrial Control Systems (ICS) and has documented them in its Operational Technology (OT) inventory.

  While validating the OSC's proposed assessment scope, the Assessment Team reviews their SSP.

  How should the C3PAO Assessment Team handle the OSC's OT during the assessment?

  A. Accept the OSC's documentation of policies and procedures as they are.
  B. Assess them against CA.L2-3.12.3 - Security Control Monitoring.
  C. Assess them against all CMMC practices.
  D. Review the SSP and not assess the OT against other CMMC practices.
  D. Review the SSP and not assess the OT against other CMMC practices.

• Question 230:

  An aerospace company has requested a CMMC assessment for an enclave only. Your team has verified that the company has a valid CAGE code and is registered with SAM.gov. However, the enclave has no separate CAGE code or SAM registration.

  Can the assessor proceed with the CMMC assessment solely for the enclave, or is an assessment of the entire aerospace company's network required?

  A. The assessor can proceed with the enclave assessment for CMMC Level 2 compliance.
  B. The assessor cannot proceed with the enclave assessment.
  C. The assessor must assess the entire company network.
  D. The assessor can proceed with the enclave assessment, but only for a lower CMMC level.
  A. The assessor can proceed with the enclave assessment for CMMC Level 2 compliance.