Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 251:

  You are assessing Conedge Ltd, a contractor that develops cryptographic algorithms for classified government networks. In reviewing their network architecture documents, you see they have implemented role-based access controls on their workstations using Active Directory group policies. Software developers are assigned to the "Dev_Roles" group which grants access to compile and test code modules.

  The "Admin_Roles" group with elevated privileges for system administration activities is restricted to the IT staff. However, when you examine the event logs on a developer workstation, you find evidence that a developer was able to enable debugging permissions to access protected kernel memory - a privileged function.

  Which of the following controls could have prevented the developer from executing this privileged function?

  A. Removing internet access
  B. Prohibiting inheritance of privileged permissions
  C. Enforcing dual authorization
  D. Implementing time of day restrictions
  B. Prohibiting inheritance of privileged permissions

• Question 252:

  A CCA is conducting a CMMC assessment and notices that the OSC's evidence includes a policy document that is outdated by two years. The OSC insists that the policy is still in effect, but staff interviews indicate that newer, undocumented procedures are being followed.

  How should the CCA handle this situation?

  A. Accept the outdated policy as evidence since the OSC claims it is still in effect.
  B. Document the discrepancy between the policy and actual procedures and assess based on all available evidence.
  C. Reject the policy document outright and score the practice as "NOT MET."
  D. Request the OSC to update the policy document before proceeding with the assessment.
  B. Document the discrepancy between the policy and actual procedures and assess based on all available evidence.

• Question 253:

  A C3PAO is conducting a Level 2 assessment of a midsized construction contractor that does both private (commercial) and federal work. The contractor's documentation states that all CUI flows through a single building on their office campus and is logically, physically, and administratively isolated from the rest of the environment.

  Why might an assessor request access to assess controls within a building or area not listed as in-scope in the documentation?

  A. If the assessor sees personnel carrying locked cases into the other building or area
  B. If the OSC has an underground passageway connecting the CUI building to a non-CUI building
  C. If network diagrams indicate the commercial and federal sectors share a single Internet connection
  D. If Human Resources that supports both commercial and federal sectors sits in the other building or area
  C. If network diagrams indicate the commercial and federal sectors share a single Internet connection

  ---

  Explanation

  A shared Internet connection indicates that Security Protection Assets (SPAs) are present and serving both the CUI environment and other parts of the enterprise. SPAs are always in-scope regardless of where they are located, because they provide security protections for CUI. Therefore, if documentation or diagrams show that the commercial and federal environments share a single Internet connection, the assessor must request access to the other building to confirm proper implementation and isolation.

  Exact Extracts (from CMMC Assessor/Study documents): "Security Protection Assets provide security functions or capabilities within the OSA's CMMC Assessment Scope. Security Protection Assets are part of the CMMC Assessment Scope and are assessed against Level 2 security requirements that are relevant to the capabilities provided."

  "Contractor Risk Managed Assets are not required to be physically or logically separated from CUI Assets... If documentation or other findings raise questions about these assets, the assessor can conduct a limited check to identify deficiencies."

  "Separation... is required only for Out-of-Scope Assets. Isolation can be achieved... by implementing subnetworks with firewalls or other boundary protection devices."

  "The CMMC Assessment Scope includes all assets in the OSA's environment that will be assessed...

  OSAs will be required to provide a network diagram of the CMMC Assessment Scope to facilitate scoping discussions during pre-assessment." "An OSC can obtain a Level 2 certification assessment for an entire enterprise network or for a specific enclave(s), depending upon how the CMMC Assessment Scope is defined..."

  Why the other options are not correct:

  Option A (locked cases): Physical movement of materials does not establish scope. Scoping is determined by CUI flow and security protection assets, not incidental observation of personnel activities.

  Option B (underground passageway): Physical tunnels or building connections do not affect scope unless they result in shared IT/security functions.

  Option D (HR location): HR is not a SPA because it does not provide security functions to protect CUI. Unless HR systems process or store CUI directly, they remain out of scope.

  References (official CCA/CMMC documents):

  CMMC Assessment Scope - Level 2, Version 2.13 (Scoping Guide): Asset Categories, SPA definitions and examples; CRMA limited-check language; Separation requirements; network diagram requirements (pp.3-

  13. .

  CMMC Assessment Guide - Level 2, Version 2.13: Assessment scope, enclave validation, and assessor methods (pp. 1-4, 8-10).

• Question 254:

  In an effort to understand whether the OSC appropriately defined the scope to exclude items that should not be assessed, which description does NOT belong in the scope?

  A. Data center in another state used by the OSC
  B. A smoke detector that is connected to the OSC network
  C. The SIEM tool used by the managed service provider in managing the OSC
  D. The office where its managed service provider's management office is located
  B. A smoke detector that is connected to the OSC network

  ---

  Explanation

  CMMC scoping focuses on assets that process, store, transmit, or protect CUI. A smoke detector connected to the OSC network is an IoT device with no impact on CUI, so it is considered Out-of-Scope.

  The other items (data centers used by the OSC, MSP SIEM tools, and MSP offices handling OSC management) all directly affect the OSC's CUI environment and therefore fall within scope.

  Exact extracts:

  "CUI Assets are those that process, store, or transmit CUI."

  "Security Protection Assets are those that provide security functions for CUI Assets." "External Service Providers (e.g., MSPs, data centers, SIEMs) that support CUI Assets are in-scope." "Assets that cannot affect the confidentiality of CUI (e.g., unrelated IoT devices) are considered Out-of-Scope."

  Data centers (A): If OSC CUI is stored or processed there, they are in-scope.

  SIEM tools (C): Provide security monitoring of OSC networks - a clear Security Protection Asset.

  MSP office (D): MSPs providing services that affect CUI are in-scope, including their management locations.

  Smoke detector (B): Despite being network-connected, it does not interact with CUI or provide protective functions; it is explicitly out-of-scope.

  Why the other options are in scope: They either process, protect, or manage CUI directly. Excluding them would improperly narrow the assessment boundary.

• Question 255:

  After you ask to examine some audit records, the contractor's system administrator informs you that there is a process to follow before accessing them. The logs are hashed using SHA-512 algorithms, and the system administrator has to run an algorithm to recalculate the hashes for the audit records to verify their integrity before running a decryption algorithm to decrypt the data. Since this might take some time, you tour the facility while interviewing personnel with audit and accountability roles. You see an employee holding the door for another without using their physical access card. While interviewing the contractor's employees, you find that they can access all audit logging tools and tweak the settings according to their needs or requirements. Upon examining the contractor's access control policy, you realize they have not defined the measures to protect audit logging tools.

  Considering CMMC AU.L2-3.3.8 - Audit Protection and best practices, which of the following is the MOST concerning finding regarding the employees' access to audit logging tools?

  A. Employees have unrestricted access to all audit logging tools and can modify settings
  B. Employees hold doors for others without requiring physical access cards
  C. The system administrator needs to recalculate hashes for audit record verification before decryption
  D. Audit logs are encrypted and hashed for integrity verification
  A. Employees have unrestricted access to all audit logging tools and can modify settings

• Question 256:

  A company describes its organization as having two systems. One system, System Org, covers the entire organization and allows instant messaging, email, and Internet activity. The other system, System CUI, is used for processing, storing, and transmitting CUI data. System CUI interfaces with System Org through security mechanisms and a firewall. The CMMC Assessment is being done on System CUI only.

  What is the BEST way to describe System CUI?

  A. CUI Assets
  B. In-Scope Assets
  C. Out-of-Scope Assets
  D. CUI Assets and Security Protection Assets
  A. CUI Assets

  ---

  Explanation

  Per the CMMC Scoping Guidance, CUI Assets are those that process, store, or transmit CUI. Since System CUI is the system handling CUI data, it must be categorized as CUI Assets.

  Extract:

  "CUI Assets are any assets that process, store, or transmit CUI. These assets are in-scope for assessment and must meet CMMC practice requirements."

  Thus, the best classification for System CUI is CUI Assets.

• Question 257:

  A CCA is part of an Assessment Team conducting a CMMC Level 2 assessment. During an interview, an OSC employee admits that a critical security practice is not implemented because "it's too expensive." The CCA responds by suggesting a low-cost alternative solution to implement the practice.

  What should the CCA have done instead?

  A. Noted the employee's statement and continued the interview without offering any suggestions.
  B. Reported the employee's statement to the OSC management immediately.
  C. Encouraged the employee to discuss the issue with their supervisor after the interview.
  D. Paused the interview to consult with the Lead Assessor about the practice's cost implications.
  A. Noted the employee's statement and continued the interview without offering any suggestions.

• Question 258:

  An OSC has built an enclave for its production environment. The enclave sits behind a firewall, with all equipment connected through a switch. There is a shipping workstation and physically connected label printer (used for the sales system, which does not process CUI) that the OSC claims are Contractor Risk Managed Assets (CRMA). Other than showing that the shipping workstation and label printer are not intended to store or transmit CUI, and documenting them in the SSP.

  How BEST would the OSC show that the shipping workstation and label printer are Contractor Risk Managed Assets?

  A. Document in the asset inventory and include them in the network diagram to facilitate scoping discussions during the pre-assessment.
  B. Document the shipping workstation and label printer in the asset inventory; show that they are managed using vendor-recommended risk-based security practices; and include them in the network diagram.
  C. Document the shipping workstation and label printer in the asset inventory; show that they are managed using the organization's risk-based security policies and procedures; and include them in the network diagram.
  D. Document the shipping workstation and label printer in the asset inventory; show that they are managed using industry risk-based security best practices; and include them in the network diagram to facilitate scoping discussions during the pre-assessment.
  C. Document the shipping workstation and label printer in the asset inventory; show that they are managed using the organization's risk-based security policies and procedures; and include them in the network diagram.

  ---

  Explanation

  The CMMC Scoping Guidance specifies that Contractor Risk Managed Assets must: Be documented in the asset inventory, Be governed by the organization's own risk-based policies and procedures, Be included in the system boundary/network diagram.

  Extract:

  "Contractor Risk Managed Assets are those managed according to the OSC's risk-based policies and procedures. They must be documented in the asset inventory and represented in the system boundary."

  Thus, option C is the best answer.

• Question 259:

  An OSC is planning a CMMC Level 2 assessment that your C3PAO will conduct. In Phase 1.6.1 - Access and Verify Evidence, as the Lead Assessor, you are verifying the existence and accessibility of the evidence provided by the OSC. While reviewing the list of evidence mapped against the CMMC practices, you discover that the OSC cannot locate several critical system security policies for key IT systems supporting their DoD contracts. These missing policies are essential for demonstrating compliance with various CMMC practices related to access control, incident response, and system maintenance.

  What is the primary role of the CMMC Quality Assurance Professional (CQAP) regarding the Pre-Assessment Form?

  A. To verify the accuracy and completeness of the information before uploading to CMMC eMASS.
  B. To assign roles and responsibilities for each Assessment Team member.
  C. To schedule CMMC eMASS training sessions for C3PAO representatives.
  D. To configure access controls within the CMMC eMASS system.
  A. To verify the accuracy and completeness of the information before uploading to CMMC eMASS.

• Question 260:

  You are the Lead Assessor for a CMMC Level 2 assessment. During the assessment, the OSC provides evidence that a practice is inherited from a cloud service provider (CSP). The CSP has a FedRAMP Moderate authorization, and the OSC argues that this should automatically satisfy the practice's requirements.

  How should you respond?

  A. Accept the FedRAMP authorization as sufficient evidence and score the practice as "MET."
  B. Inform the OSC that FedRAMP authorization does not automatically satisfy CMMC requirements and request specific evidence from the CSP demonstrating compliance with the practice's objectives.
  C. Reject the evidence outright, as external certifications are not allowed under CMMC.
  D. Consult with the Cyber AB to determine if FedRAMP can be accepted as equivalent to CMMC requirements.
  B. Inform the OSC that FedRAMP authorization does not automatically satisfy CMMC requirements and request specific evidence from the CSP demonstrating compliance with the practice's objectives.