Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 241:

  You have been hired to assess a contractor's implementation of remote access capabilities for information systems that handle CUI. While interviewing the network administrator, you realize they perform privileged activities remotely when at alternate worksites.

  Which of the following is the BEST action the contractor can take to address the network administrator's remote execution of privileged activities, as per CMMC practice AC.L2-3.1.15 - Privileged Remote Access?

  A. Implement multifactor authentication before authorizing remote access sessions, regardless of privilege level
  B. Prohibit the remote execution of privileged commands and remote access to security-relevant information entirely
  C. Log and monitor all remote sessions
  D. Limit remote access privileges to read-only activities and prohibit any remote execution of privileged commands
  A. Implement multifactor authentication before authorizing remote access sessions, regardless of privilege level

• Question 242:

  Mobile devices are increasingly becoming important in many contractors' day-to-day activities. Thus, the contractors must institute measures to ensure they are correctly identified and any connections are authorized, monitored, and logged, especially if the devices or their connections process, store, or transmit CUI. You have been hired to assess a contractor's implementation of CMMC practices, one of which is AC.L2-3.1.18. Mobile Device Connections. To successfully test the access control capabilities authorizing mobile device connections to organizational systems, you must first identify what a mobile device is.

  Mobile devices connecting to organizational systems must have a device-specific identifier.

  Which of the following is the main consideration for a contractor when choosing an identifier?

  A. Choosing an identifier that can accommodate all devices and be used consistently within the organization
  B. Prioritize using identifiers that are easy to remember and user-friendly
  C. The identifier must be easily differentiable from one device to another
  D. Use random identifiers to identify mobile devices on the network easily
  A. Choosing an identifier that can accommodate all devices and be used consistently within the organization

• Question 243:

  During the on-site assessment, the assessment team thoroughly evaluated an OSC's systems, policies, procedures, and practices against the 110 CMMC Level 2 practices. Initially, they found several deficient areas where practices were not fully met. The OSC took advantage of the Limited Practice Deficiency Correction program, which allowed them to provide additional evidence and implement corrections for certain deficient practices during the assessment period.

  What status should the Lead Assessor recommend for CMMC Level 2 Certification if an OSC has 85 out of 110 practices scored as `MET' after applying the Limited Practice Deficiency Correction program?

  A. The Lead Assessor will recommend the OSC receive a final finding of "Not Achieved" for CMMC Level 2 Certification. The OSC will be required to correct deficiencies and reapply for CMMC L2 Certification.
  B. Defer the recommendation until the OSC has fully remediated all `NOT MET' practices through a Plan of Action and Milestones (POA&M).
  C. Recommend `CMMC Level 2 Conditional Certification' with a requirement to correct the remaining deficiencies within a specified timeframe.
  D. Recommend `CMMC Level 2 Certification' without any conditions.
  A. The Lead Assessor will recommend the OSC receive a final finding of "Not Achieved" for CMMC Level 2 Certification. The OSC will be required to correct deficiencies and reapply for CMMC L2 Certification.

• Question 244:

  You are a CCA who is part of an Assessment Team conducting a CMMC assessment on an aerospace company. While analyzing their network architecture, you realize that it includes a Demilitarized Zone (DMZ) to host their public-facing web servers.

  What is the primary purpose of a DMZ in a network architecture?

  A. To physically isolate the organization's internal network from the internet
  B. To provide physical security for the organization's public-facing web servers
  C. To allow unrestricted access between the internal network and the internet
  D. To logically isolate the organization's public-facing web servers from the internal network
  D. To logically isolate the organization's public-facing web servers from the internal network

• Question 245:

  An Assessor is evaluating controls put in place by an OSC to restrict the use of privileged accounts. The Assessor interviews privileged users and confirms that the OSC has both a policy and specific procedures governing the use of privileged accounts for security functions.

  What else could the Assessor evaluate to validate the assertions made by the interviewed OSC staff?

  A. Examine the system architecture of the OSC to identify privileged accounts
  B. Test the processes for non-privileged accounts to perform privileged functions
  C. Examine the procedure assigning privileged roles to non-privileged functions
  D. Test the processes for privileged accounts with privileged users
  A. Examine the system architecture of the OSC to identify privileged accounts

  ---

  Explanation

  For AC.L2-3.1.7 (Restrict Use of Privileged Accounts), it is not enough to rely on interviews or documented procedures. The assessor must also Examine technical evidence to ensure that privileged accounts exist as described and are properly controlled. Reviewing system architecture, account listings, and role assignments validates that privileged access aligns with policy and that inappropriate assignments do not exist.

  Exact extracts:

  "Assessment Objectives... Determine if: privileged accounts are identified; privileged functions are restricted to privileged accounts; and use of privileged accounts is monitored." "Assessment Methods -

  Examine: account management policy; system architecture documentation; system security plan; privileged account listings." "Assessment Methods -

  Test: attempt to use non-privileged accounts to execute privileged functions."

  Why other options are incorrect:

  Option B: Testing non-privileged accounts is useful but is not the next immediate validation step after confirming policy/procedures. Examination comes first.

  Option C: This phrasing implies giving privileged roles to non-privileged functions, which would itself be a finding.

  Option D: Testing with privileged users verifies activity monitoring, but not whether privileged accounts are properly scoped.

  References:

  CMMC Assessment Guide - Level 2, AC.L2-3.1.7 "Restrict Use of Privileged Accounts." NIST SP 800-171 Rev. 2, 3.1.7.

• Question 246:

  During an assessment, it is uncovered that a CCA worked as a consultant for the OSC through their RPO.

  Unfortunately, the CCA didn't disclose this when their C3PAO appointed them to participate in the assessment.

  Did the CCA behave professionally?

  If not, what issues are likely to arise?

  A. Yes, the CCA behaved professionally.
  B. No, lack of objectivity.
  C. No, assessor bias.
  D. No, breach of confidentiality.
  C. No, assessor bias.

• Question 247:

  You are a CCA participating in an assessment exercise for an OSC. You have completed the exercise, and the OSC has hashed the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide.

  What is the next step for your Assessment Team with respect to the Evidence Artifact Hashes?

  A. Tell the OSC to encrypt the hash.
  B. Upload the Hashes to the OSC's CMMC eMASS.
  C. Upload them to your C3PAO's cloud instance.
  D. Nothing, the assessment is complete.
  B. Upload the Hashes to the OSC's CMMC eMASS.

• Question 248:

  You are a Lead Assessor working with your C3PAO to conduct a CMMC Assessment for an OSC. During the preparation and planning phase, you meet with the OSC's Assessment Official to identify the resources and schedule for the upcoming assessment. Together, you review the OSC's pre-assessment information to estimate the level of effort required. You then collaborate to determine the specific resources needed, including the Assessment Team members, facilities, and any support personnel from the OSC. You also discuss scheduling factors like duration, key activities, and potential constraints. Based on these discussions, you develop a Rough Order of Magnitude (ROM) cost estimate and a proposed daily schedule for the assessment activities.

  Which of the following is not a requirement when identifying resources and schedules?

  A. Documenting the names and roles of all assessment participants.
  B. Recording the facilities to be used and their configurations.
  C. Negotiating the pricing structure of the contract with the OSC.
  D. Identifying potential triggers for replanning or updating the assessment plan.
  C. Negotiating the pricing structure of the contract with the OSC.

• Question 249:

  An OSC uses an External Service Provider (ESP) to support part of its CUI processing scope. The OSC has selected an accredited ESP with FedRAMP MODERATE authorization. The OSC has a contract requiring the ESP to meet its security requirements. The ESP has provided a Shared Responsibility Matrix (SRM) consistent with the contract terms.

  When assessing these assets, what should the assessor MOST carefully review?

  A. The contract terms to ensure that the OSC's CMMC Level 2 requirements are in the contract, and the SRM to ensure that the shared responsibilities are well defined.
  B. The contract terms to ensure that the OSC's CMMC Level 2 requirements are in the contract, and the SRM to ensure that the ESP's responsibilities are well defined.
  C. The ESP's FedRAMP MODERATE authorization to ensure the OSC's CMMC Level 2 requirements are MET, and the SRM to ensure that the ESP's responsibilities are well defined.
  D. The ESP's FedRAMP MODERATE authorization to ensure the OSC's CMMC Level 2 requirements are MET, and the SRM to ensure that the shared responsibilities are well defined.
  A. The contract terms to ensure that the OSC's CMMC Level 2 requirements are in the contract, and the SRM to ensure that the shared responsibilities are well defined.

  ---

  Explanation

  The CAP and Scoping Guidance specify that the assessor must review both: The contract - to confirm that the OSC's CMMC requirements are flowed down to the ESP, and The Shared Responsibility Matrix - to confirm responsibilities are clearly assigned between OSC and ESP.

  Extract:

  "Assessors must review contracts and shared responsibility matrices to ensure that OSC responsibilities and provider responsibilities are clearly defined, and that requirements are flowed down appropriately."

  Thus, option is the most complete.A References:

  CMMC Scoping Guidance - External Service Providers CAP.

• Question 250:

  An OSC has a large multi-building facility. One building is used as the OSC's data center. A guard is stationed at the entrance to the data center. A vendor engineer comes onsite to perform maintenance on the storage array in the data center. The guard knows the engineer well and has the engineer fill out the visitor log with the contact person's name and phone number, the reason for the visit, and the date and time.

  Since the guard has known the engineer for many years, what is the BEST step the guard should take?

  A. Call the contact person and let her know that the engineer is onsite and give the engineer a temporary badge to enter the data center.
  B. Call the operations center to give the engineer temporary access to enter the data center and escort the engineer to the array and leave.
  C. Call the contact person to have her come down and escort the engineer to the array and stay with the engineer until the maintenance is complete.
  D. Call the operations center to have one of the admins escort the engineer to the array and stay with the engineer until the maintenance is complete.
  C. Call the contact person to have her come down and escort the engineer to the array and stay with the engineer until the maintenance is complete.

  ---

  Explanation

  The Physical Protection (PE) practices require that visitors to facilities where CUI is processed must be escorted at all times by an authorized individual. Familiarity or long-term knowledge of the visitor does not remove the requirement.

  Extract from PE.L2-3.10.3: "Escort visitors and monitor visitor activity to ensure they do not access areas or information for which they are not authorized."

  Thus, the correct action is for the contact person (the engineer's point of contact) to escort the engineer during the entire maintenance activity.

  References:

  CMMC Assessment Guide - Level 2, PE.L2-3.10.3.