Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 241:

  You decide to interview the IT security team to understand if and how a contractor has implemented audit failure alerting. You learn they have deployed AlienVault OSSIM, a feature-rich security information and event management (SIEM) tool. The SIEM tool has been configured to send automatic alerts to system and network administrators if an event affects the audit logging process. Alerts are generated for the defined events that lead to failure in audit logging and can be found in the notification section of the SIEM portal. However, the alerts are sent to the specified personnel 24 hours after the occurrence of an event. As an assessor evaluating the implementation of AU.L2-3.3.4 ?Audit Failure Alerting, which of the following would be a key consideration regarding the evidence provided by the contractor?

  A. Ensuring the defined alert notification methods (e.g., email, SMS) are secure and encrypted
  B. Verifying that the types of audit logging failures defined cover a comprehensive range of potential scenarios
  C. Determining if the documented personnel roles for alert notification align with the organization's hierarchy
  D. Checking if the alert notification process integrates with third-party monitoring services
  B. Verifying that the types of audit logging failures defined cover a comprehensive range of potential scenarios

• Question 242:

  You have been hired to assess a contractor's implementation of remote access capabilities for information systems that handle CUI. While interviewing the network administrator, you realize they perform privileged activities remotely when at alternate worksites. Which of the following is the BEST action the contractor can take to address the network administrator's remote execution of privileged activities, as per CMMC practice AC.L2-3.1.15 ?Privileged Remote Access?

  A. Implement multifactor authentication before authorizing remote access sessions, regardless of privilege level
  B. Prohibit the remote execution of privileged commands and remote access to security- relevant information entirely
  C. Log and monitor all remote sessions
  D. Limit remote access privileges to read-only activities and prohibit any remote execution of privileged commands
  A. Implement multifactor authentication before authorizing remote access sessions, regardless of privilege level

• Question 243:

  A CCA is assessing an Organization Seeking Certification (OSC). During the assessment, they discover that the OSC is pressuring the CCA to overlook certain security practices that do not meet the CMMC requirements. The organization threatens to withhold payment if the CCA does not modify her findings at the request of the OSC. According to the CoPC, which of the following actions would be most appropriate for the CCA to take in this situation?

  A. Inform the OSC that the pressure to compromise her values is a violation of the CoPC and report the issues to the C3PAO.
  B. Complete the assessment and then report the OSC's unethical practices to the Cyber AB.
  C. Comply with the organization's requests to avoid the risk of non-payment and complete the assessment.
  D. Discuss the concerns with the OSC, continue the assessment, and report the violations only if they are not resolved.
  A. Inform the OSC that the pressure to compromise her values is a violation of the CoPC and report the issues to the C3PAO.

• Question 244:

  As the Lead Assessor for your Assessment Team, you are validating an OSC's scope in readiness to start the assessment. You learn that the OSC provides its employees with laptops to work on DoD projects. These laptops have an antivirus solution that connects to a management console to receive updates, send alerts, and control settings. However, the server does not process, store, or transmit CUI but implements several CMMC controls. Which of the following is NOT part of the OSC's requirements regarding the antivirus solution?

  A. Itemize the solution in the CMMC Assessment Scope's network diagram and prepare it to be assessed against CMMC practices.
  B. They should document the specifics of the antivirus solution in the asset inventory.
  C. The OSC should document it in the System Security Plan (SSP).
  D. Logically separate the antivirus solution from other CUI assets.
  D. Logically separate the antivirus solution from other CUI assets.

• Question 245:

  During your assessment of CA.L2-3.12.3 ?Security Control Monitoring, the contractor's CISO informs you that they have established a continuous monitoring program to assess the effectiveness of their implemented security controls. When examining their security planning policy, you determine they have a list of automated tools they use to track and report weekly changes in the security controls. The contractor has also established a feedback mechanism that helps them identify areas of improvement in their security controls. Chatting with employees, you understand the contractor regularly invites resource persons to train them on the secure handling of information and identifying gaps in security controls implemented. You would rely on all of the below evidence to assess the contractor's implementation of CA.L2-3.12.3 ?Security Control Monitoring, EXCEPT?

  A. Records/logs of monitoring activities over time
  B. Customer feedback on the contractor's security measures
  C. Reports or dashboards from the monitoring activities
  D. The contractor's security monitoring policies and procedures
  B. Customer feedback on the contractor's security measures

• Question 246:

  In ensuring it meets its mandates to protect CUI under CMMC, a contractor has implemented a robust, dynamic session lock with pattern-hiding displays to prevent access and viewing of data. After every 5 minutes of inactivity, the current session is locked and a blank, black screen with a battery life indicator is displayed. As a CCA, you will potentially use the following assessment methods to examine the contractor's implementation of session lock EXCEPT?

  A. Interview the system administrator
  B. Examine the system design documentation
  C. Test the strength of the user's password
  D. Test the mechanisms implementing the access control policy for session lock
  C. Test the strength of the user's password

• Question 247:

  During the assessment process, a CCA encounters a situation in which the evidence provided by the OSC raises concerns about its adequacy and alignment with the CMMC practice being assessed. What priority factors must the CCA have considered to arrive at these concerns?

  A. The format and presentation of the evidence
  B. The completeness of the evidence across all systems and processes
  C. The level of detail and granularity provided in the evidence
  D. Whether the evidence is the right evidence and meets the intent of the CMMC practice
  D. Whether the evidence is the right evidence and meets the intent of the CMMC practice

• Question 248:

  An OSC employs guards to protect the manufacturing shop where a magnetic radar- absorbing coating is manufactured. This specific coating is used by the Army for a particular fleet ofunmanned aerial vehicles (UAVs). The facility is under constant surveillance with the help of HD CCTVs. Within the OSC's facilities, there is a Vector Network Analyzer (VNA) that measures the reflection and transmission properties of the coating over a range of frequencies. Guards protect the OSC's anechoic chamber, and anyone entering must use an iris scanner and sign a physical form detailing their name and reason for being there. At the door is a huge sign reading "Authorized Personnel Only." Which of the following statements is true about handling the Vector Network Analyzer (VNA) in a CMMC assessment?

  A. The VNA is out of scope for a CMMC assessment.
  B. The VNA should be reviewed in the SSP in accordance with practice CA.L2-3.12.4 - System Security Plan.
  C. The VNA should be assessed against CMMC practices.
  D. If appropriately documented, the assets should not be assessed against other CMMC practices.
  B. The VNA should be reviewed in the SSP in accordance with practice CA.L2-3.12.4 - System Security Plan.

• Question 249:

  While examining a contractor's audit and accountability policy, you realize they have documented types of events to be logged and defined content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activities. After the logs are analyzed, the results are fed into a system that automatically generates audit records stored for 30 days. However, mechanisms implementing system audit logging are lacking after several tests because they produce audit logs that are too limited. You find that generated logs cannot be independently used to identify the event they resulted from because the defined content specified therein is too limited. Additionally, you realize the logs are retained for 24 hours before they are automatically deleted. Which of the following is a potential assessment method for AU.L2- 3.3.1 ?System Auditing?

  A. Examine procedures addressing audit record generation
  B. Testing procedures addressing control of audit records
  C. Testing the system configuration settings and associated documentation
  D. Examining the mechanisms for implementing system audit logging
  A. Examine procedures addressing audit record generation

• Question 250:

  While reviewing a contractor's Microsoft Active Directory authentication policies, you observe that the account lockout threshold is configured to allow 5 consecutive invalid login attempts before locking the account for 15 minutes. Additionally, the reset account lockout counter is set to 30 seconds after each unsuccessful login attempt. Based on this scenario, which of the following statements are TRUE about the contractor's implementation of CMMC practice AC.L2-3.1.8 ? Unsuccessful Logon Attempts?

  A. The contractor has successfully implemented practice AC.L2-3.1.8 ?Unsuccessful Logon Attempts warranting a score of MET
  B. The contractor's approach does not provide sufficient protection against unauthorized access attempts
  C. Based on the current implementation, CMMC practice AC.L2-3.1.8 cannot be scored as MET
  D. The contractor's approach does not adequately address the required assessment objectives
  A. The contractor has successfully implemented practice AC.L2-3.1.8 ?Unsuccessful Logon Attempts warranting a score of MET