Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 221:

  You are a Lead Assessor working with your C3PAO to conduct a CMMC Assessment for an OSC. During the preparation and planning phase, you meet with the OSC's Assessment Official to identify the resources and schedule for the upcoming assessment. Together, you review the OSC's pre-assessment information to estimate the level of effort required. You then collaborate to determine the specific resources needed, including the Assessment Team members, facilities, and any support personnel from the OSC. You also discuss scheduling factors like duration, key activities, and potential constraints. Based on these discussions, you develop a Rough Order of Magnitude (ROM) cost estimate and a proposed daily schedule for the assessment activities. What is your primary responsibility in identifying resources and schedule during Phase 1?

  A. Finalizing the contract agreement between the C3PAO and OSC.
  B. Selecting the assessment team members and their roles.
  C. Determining the overall cost estimate for the assessment.
  D. Verifying that all planning requirements are met when constructing the ROM estimate.
  D. Verifying that all planning requirements are met when constructing the ROM estimate.

• Question 222:

  CMMC MA.L2-3.7.6 ?Maintenance Personnel requires that maintenance personnel without required access authorization be supervised during maintenance activities. One of the ways organizations can achieve this is to develop a documented procedure for supervised maintenance activities. Which of the following elements should be excluded from the documented procedure?

  A. A detailed list of all CUI assets that the maintenance activity might impact
  B. The specific steps authorized for the visiting maintenance personnel with limited access
  C. Contact information for the organization's IT security team in case of emergencies or unexpected issues
  D. The method used to authenticate and monitor the supervisor's activity during the maintenance session
  A. A detailed list of all CUI assets that the maintenance activity might impact

• Question 223:

  During a CMMC assessment, the Assessment Team observes that the OSC is not enforcing practice objective CM.L2-3.4.5[d] ?physical access restrictions associated with changes to the system are enforced. Understanding the deficiency, the OSC has requested to track the practice in the Limited Practice Deficiency Correction program, as it is part of their on-premises work. As a CCA, what should you do with respect to the OSC's implementation of this practice?

  A. Agree with the OSC and track the practice under the Limited Practice Deficiency Correction program.
  B. Report the OSC to Cyber AB.
  C. Mark it as `NOT MET'.
  D. Score the practice as `MET' since only one objective is not fulfilled.
  C. Mark it as `NOT MET'.

• Question 224:

  You are a CCA collaborating with an OSC to provide specialized consulting services. The OSC representative has inquired about strategies to validate the accuracy of their project scope. In response, you suggest leveraging a data flow diagram. This visual representation could assist in mapping the flow of information and processes within the project, enabling a comprehensive review and verification of the scope's alignment with the client's requirements. If you were on the Assessment Team, how would you use the data flow diagram after it is created?

  A. Use the data flow diagram to identify potential vulnerabilities and weaknesses in the information flow, as it is primarily a security analysis tool
  B. Use the data flow diagram as a baseline for a new system architecture, as it provides a comprehensive view of the existing data flows
  C. Compare the data flow diagram with the organization's documented policies and procedures to identify any deviations or noncompliance
  D. Ensure the systems and assets included in the data flow diagram are also included in the network diagram for the assessment's scope and in the asset inventory
  D. Ensure the systems and assets included in the data flow diagram are also included in the network diagram for the assessment's scope and in the asset inventory

• Question 225:

  You are part of an Assessment Team tasked with conducting a CMMC Assessment for an OSC. When assessing the contractor's implementation of SC.L2-3.13.6 ?Network Communication by Exception, objectives [a] and [b], the OSC's system admin informs you that they use Fortinet Next-Generation Firewall (NGFW). Fortinet NGFWs are hardcoded to deny all traffic by default, and traffic is only allowed on an exception basis. While this is factual, the Lead Assessor asks you to test the NGFW to ascertain whether it meets the intent of Assessment Objectives in SC.L2-3.13.6 ?Network Communication by Exception. What is the benefit of testing as an assessment method?

  A. Testing helps determine if CMMC practices are implemented and whether adequate resources were provided to the individuals performing the practices.
  B. Testing allows you to observe what has been done and what has not been done.
  C. Testing allows you to determine if the OSC has the intent to meet the Assessment Objectives.
  D. Testing provides insight into the OSC's handling of CMMC practices.
  B. Testing allows you to observe what has been done and what has not been done.

• Question 226:

  An OSC has submitted an assessment scope that includes some CUI and security protection assets. As a Lead Assessor, you are validating the CMMC assessment scope in preparation for a CMMC assessment for the OSC. How should you handle CUI and Security Protection Assets during the actual CMMC assessment?

  A. Assess the assets against a subset of the 110 controls.
  B. Conduct limited spot checks.
  C. Review only in the OSC's SSP.
  D. Assess the assets against the 110 CMMC practices.
  D. Assess the assets against the 110 CMMC practices.

• Question 227:

  After you ask to examine some audit records, the contractor's system administrator informs you that there is a process to follow before accessing them. The logs are hashed using SHA-512 algorithms, and the system administrator has to run an algorithm to recalculate the hashes for the audit records to verify their integrity before running a decryption algorithm to decrypt the data. Since this might take some time, you tour the facility while interviewing personnel with audit and accountability roles. You see an employee holding the door for another without using their physical access card. While interviewing the contractor's employees, you find that they can access all audit logging tools and tweak the settings according to their needs or requirements. Upon examining the contractor's access control policy, you realize they have not defined the measures to protect audit logging tools. Considering CMMC AU.L2-3.3.8 ?Audit Protection and best practices, which of the following is the MOST concerning finding regarding the employees' access to audit logging tools?

  A. Employees have unrestricted access to all audit logging tools and can modify settings
  B. Employees hold doors for others without requiring physical access cards
  C. The system administrator needs to recalculate hashes for audit record verification before decryption
  D. Audit logs are encrypted and hashed for integrity verification
  A. Employees have unrestricted access to all audit logging tools and can modify settings

• Question 228:

  During the examination of evidence for access control procedures, you review an OSC's Access Control List (ACL). The ACL appears to include most user accounts, but you notice that it lacks entries for several newly hired employees. You also realize that some parts of the OSC's access control policy haven't been signed and endorsed by senior management. Additionally, you notice multiple attestations from employees who are not the proper system owners. How should you proceed when encountering an incomplete artifact, such as the missing personnel in the access control list?

  A. Request the OSC to provide a revised, complete version of the artifact within a specified timeframe.
  B. Disregard the incomplete artifact and rely on other evidence for the practice assessment.
  C. Document the incomplete artifact as an evidence gap and proceed with assessing the practice based on the available evidence.
  D. Mark the associated CMMC practice as 'NOT MET' due to the incomplete artifact.
  C. Document the incomplete artifact as an evidence gap and proceed with assessing the practice based on the available evidence.

• Question 229:

  A CMMC Level 2 certified DoD contractor plans to use a Cloud Service Provider (CSP) to support data storage and application hosting for their business operations. The contractor is aware of the CMMC requirements and wants to ensure compliance before engaging with the cloud service provider. After discussing this with them, you learn that most of the hosted applications aren't used for any activities related to the DoD contract. However, the stored data may contain Controlled Unclassified Information (CUI). What requirement must the CSP have met before the DoD contractor can hire them?

  A. FedRAMP High ATO
  B. Employment of personnel compliant with DoD 8570 requirements
  C. CMMC Level 1 Certification
  D. Security requirements equivalent to the FedRAMP Moderate baseline or CMMC Level 2 Certification
  D. Security requirements equivalent to the FedRAMP Moderate baseline or CMMC Level 2 Certification

• Question 230:

  You are the Lead Assessor for a CMMC assessment. During the Final Findings Briefing, the OSC Assessment Official disputes a "NOT MET" finding, claiming the evidence was misinterpreted. What is the OSC's recourse according to the CMMC Assessment Process?

  A. Request an immediate reassessment by the same Assessment Team.
  B. Submit an appeal using the Assessment Appeals Process outlined in the CAP.
  C. Demand that the Lead Assessor revise the finding based on their explanation.
  D. Reapply for a new assessment with a different C3PAO.
  B. Submit an appeal using the Assessment Appeals Process outlined in the CAP.