Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 231:

  During the on-site assessment, the assessment team thoroughly evaluated an OSC's systems, policies, procedures, and practices against the 110 CMMC Level 2 practices. Initially, they found several deficient areas where practices were not fully met. The OSC took advantage of the Limited Practice Deficiency Correction program, which allowed them to provide additional evidence and implement corrections for certain deficient practices during the assessment period.

  What status should the Lead Assessor recommend for CMMC Level 2 Certification if an OSC has 85 out of 110 practices scored as `MET' after applying the Limited Practice Deficiency Correction program?

  A. The Lead Assessor will recommend the OSC receive a final finding of "Not Achieved" for CMMC Level 2 Certification. The OSC will be required to correct deficiencies and reapply for CMMC L2 Certification.
  B. Defer the recommendation until the OSC has fully remediated all `NOT MET' practices through a Plan of Action and Milestones (POA&M).
  C. Recommend `CMMC Level 2 Conditional Certification' with a requirement to correct the remaining deficiencies within a specified timeframe.
  D. Recommend `CMMC Level 2 Certification' without any conditions.
  A. The Lead Assessor will recommend the OSC receive a final finding of "Not Achieved" for CMMC Level 2 Certification. The OSC will be required to correct deficiencies and reapply for CMMC L2 Certification.

• Question 232:

  When assessing a contractor's implementation of CMMC practices, you examine its System Security Plan (SSP) to identify its documented measures for audit reduction and reporting. They have a dedicated section in their SSP addressing the Audit and Accountability requirements. You proceed to interview their information security personnel, who informed you that the contractor has a dedicated Security Operations Center (SOC) and uses Splunk to reduce and report audit logs.

  How would you score the contractor's implementation of AU.L2-3.3.6 - Reduction&; Reporting?

  A. Partially Met
  B. Not Applicable
  C. Not Met
  D. Met
  D. Met

• Question 233:

  Conducting a CMMC assessment for an OSC includes interviewing, testing, or examining various Assessment Objects. As a CCA, you are part of an Assessment Team tasked with evaluating how an OSC has implemented AC.L2-3.1.4 - Separation of Duties.

  Which of the following is not an Assessment Object you would use to validate the OSC's implementation of AC.L2-3.1.4[a], "the duties of individuals requiring separation to reduce the risk of malevolent activity are defined"?

  A. Personnel responsible for defining divisions of responsibility and separation of duties
  B. Mechanisms that implement system audit logging
  C. The organization's Access Control Policy
  D. Mechanisms implementing the separation of duties policy
  B. Mechanisms that implement system audit logging

• Question 234:

  During scoping discussions with a Lead Assessor, the OSC mentions that there are several connected systems within the organization's network.

  How should an OSC consider security tools in a CMMC Assessment Scope?

  A. Only include network security tools in the scope.
  B. Disregard the security tools altogether.
  C. It is up to the Lead Assessor.
  D. Security tools should be considered part of the assessment scope.
  D. Security tools should be considered part of the assessment scope.

• Question 235:

  A contractor has retained you to assess compliance with CMMC practices as part of their triennial review.

  During your assessment of the AU domain, you discovered that the contractor has recently installed new nodes and servers on their network infrastructure. To assess their implementation of AU.L2-3.3.7 - Authoritative Time Source, you trigger some events documented to meet AU.L2-3.3.1 - System Auditing across both the new and existing systems, generating audit logs. Upon examining these logs, you notice inconsistencies in the timestamps between newly installed and previously existing nodes. Further investigation reveals that while the contractor has implemented a central Network Time Protocol (NTP) server as the authoritative time source, the new systems are configured to automatically adjust and

  synchronize their clocks only when the time difference with the NTP server exceeds 30 seconds.

  Based on this scenario, why is time synchronization with the NTP server necessary, and what is the recommended synchronization time?

  A. To ensure that all systems record the audit logs using the same time source, with a recommended synchronization time of 1 second
  B. To allow users to set their preferred time zones on individual systems, with a recommended synchronization time of 24 hours
  C. To reduce the network bandwidth used by system clocks, with a recommended synchronization time of once a month
  D. To increase the accuracy of digital clocks on devices, with a recommended synchronization time of 1 week
  A. To ensure that all systems record the audit logs using the same time source, with a recommended synchronization time of 1 second

• Question 236:

  You are a CCA conducting a CMMC assessment for an OSC. While evaluating Risk Assessment (RA) practices, you check how the OSC has addressed assessment objective [a] of RA.L2-3.11.1, "Determine if the frequency for assessing risk to organizational operations, organizational assets, and individuals is defined."

  Which Assessment Object would most likely provide the answer to this requirement?

  A. Risk Assessment Policy
  B. Plan of Actions
  C. Risk Assessment Report
  D. Vulnerability scanning results
  A. Risk Assessment Policy

• Question 237:

  Phase 2 of the CMMC Assessment Process specifies that the Assessment Team shall generate the final recommended assessment results. The status and recommended scores of the implemented CMMC practices are collected throughout the assessment and are reviewed with the OSC during the final daily review.

  What are the key sequential subphases that support the generation of final recommended assessment results?

  A. Determine final practice MET/NOT MET/NA results Create, finalize, and record recommended final findings Resolve assessment findings disputes
  B. Validate preliminary recommended findings and scores Resolve assessment findings disputes Submit, package, and archive assessment documentation
  C. Create, finalize, and record recommended final findings Execute POA&M review Resolve assessment findings disputes
  D. Determine final practice MET/NOT MET/NA results Validate OSC POA&M Create, finalize, and record recommended final findings
  A. Determine final practice MET/NOT MET/NA results Create, finalize, and record recommended final findings Resolve assessment findings disputes

  ---

  Explanation

  The CMMC Assessment Process (CAP), Phase 2 - Conduct the Assessment defines the subphases for generating final recommended results. The steps are:

  Determine final practice MET/NOT MET/NA results Create, finalize, and record recommended final findings Resolve assessment findings disputes

  Extract:

  "The assessment team determines the final practice status, records recommended findings, and resolves disputes with the OSC prior to finalizing recommended results."

• Question 238:

  The client has a Supervisory Control and Data Acquisition (SCADA) system as OT to be evaluated as part of its assessment. In reviewing network architecture and conducting interviews, the assessor determines that a firewall separates the SCADA system from the client's enterprise network and that CUI is not processed by the SCADA system.

  Based on this information, what is an appropriate outcome?

  A. The assessor includes the OT within the assessment
  B. The assessor determines the SCADA system is out-of-scope for the assessment
  C. The assessor includes all systems identified by the client as part of the assessment
  D. The assessor determines that all Specialized Assets are within the scope of the assessment
  B. The assessor determines the SCADA system is out-of-scope for the assessment

  ---

  Explanation

  In CMMC scoping, only assets that process, store, or transmit CUI (CUI Assets) or that can access them (Security Protection, Contractor Risk Managed, Specialized Assets) are in-scope. Since the SCADA system is firewalled off and does not handle CUI, it does not fall under CUI Asset classification and is considered Out-of-Scope.

  Exact extracts:

  "CUI Assets are those that process, store, or transmit CUI."

  "Assets that do not process, store, or transmit CUI and have no connectivity to CUI Assets are considered Out-of-Scope." "Specialized Assets... are only in-scope if they process, store, or transmit CUI."

  Why the other options are incorrect:

  Option A: Inclusion requires processing/storing/transmitting CUI.

  Option C: OSC cannot arbitrarily bring unrelated systems into scope; CUI relevance governs scope.

  Option D: Not all Specialized Assets are in-scope; only those with CUI interaction are.

  References:

  CMMC Level 2 Scoping Guide - OT/ICS/SCADA asset treatment.

• Question 239:

  You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts.

  If the OSC shares proprietary information with the Lead Assessor during the assessment engagement, what is the C3PAO's responsibility regarding this information after the completion of the assessment?

  A. The C3PAO can share the OSC's proprietary information with other clients for benchmarking purposes.
  B. The C3PAO can retain the OSC's proprietary information for future reference and use.
  C. The C3PAO is not responsible for the OSC's proprietary information once the Assessment is completed.
  D. The C3PAO must return and/or destroy any OSC proprietary information.
  D. The C3PAO must return and/or destroy any OSC proprietary information.

• Question 240:

  As a Lead Assessor, you are in contact with the OSC Assessment Official. The Assessment Official has submitted a document that outlines the scope of your assessment engagement.

  You expect to find all the following elements on the Assessment Scope document, EXCEPT?

  A. Assessment boundaries based on FCI/CUI locations and data flow
  B. Storage locations of physical information
  C. Name of the HQ organization CEO
  D. Identified networks/network enclave, enterprise, department, or service
  C. Name of the HQ organization CEO