Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 251:

  To transfer CUI between a government client and its internal systems, a defense contractor uses a Secure File-Sharing Application provided by the DoD. However, all data traversing this boundary must pass through a next-generation firewall (NGFW) managed by the contractor's Network Admin. All CUI is stored on a Solid State Drive (SSD) and accessed through a laptop. What type of asset is the Secure File-Sharing Application?

  A. Out of Scope
  B. CUI Asset
  C. Security Protection Asset (SPA)
  D. Contractor Risk Managed Asset (CRMA)
  A. Out of Scope

• Question 252:

  A vulnerability scan on a defense contractor's system identifies a critical security flaw in a legacy database application that stores CUI. Remediating the flaw would require a complete overhaul of the application, causing significant downtime and potentially disrupting critical business functions. Given the potential consequences of remediation, the contractor is considering deferring the fix. Which course of action best aligns with the guidance of CMMC practice RA.L2-3.11.3 ? Vulnerability Remediation?

  A. Immediately contract a third party to assist with remediation
  B. Document the risk acceptance rationale and continue monitoring the risk from the vulnerability
  C. Permanently disregard the vulnerability and take no further action
  D. Implement compensating controls to reduce the associated risk
  B. Document the risk acceptance rationale and continue monitoring the risk from the vulnerability

• Question 253:

  A small manufacturing company plans to undergo a CMMC assessment and needs to validate its scope. The company uses a cloud-based customer relationship management (CRM) system hosted by an external provider to store and process customer information, including FCI and CUI. Which of the following components should the company include in the scope of their CMMC assessment?

  A. The company's internal servers and client computers, but not the cloud-based CRM system or the external service provider.
  B. Only the cloud-based CRM system.
  C. The cloud-based CRM system and the external service provider's (ESP's) systems should be included in the assessment scope.
  D. Only the external service provider's systems.
  C. The cloud-based CRM system and the external service provider's (ESP's) systems should be included in the assessment scope.

• Question 254:

  During a CMMC assessment of an OSC, you discover that they rely heavily on a reputable CSP for their email services. As you delve deeper into the assessment, you suspect the OSC is incorrectly assuming that the CSP's security measures are sufficient to meet all the CMMC requirements related to email security. Given the critical nature of email communications and the potential exposure of sensitive information, you recognize the importance of clearly understanding the division of responsibilities between the OSC and the CSP for email security controls. To effectively assess how email security responsibilities are divided between the OSC and the CSP, which document should you prioritize reviewing?

  A. The OSC's overall security policy
  B. The Shared Responsibility Matrix (SRM) between the OSC and the CSP
  C. The CSP's publicly available security documentation
  D. The Service Level Agreement (SLA) between the OSC and the CSP
  B. The Shared Responsibility Matrix (SRM) between the OSC and the CSP

• Question 255:

  When validating an OSC's assessment scope, an Assessment Team learns that the proposed scope is too narrow and their asset categorization is mixed up. What should the Assessment Team do?

  A. Review the OSC's environment and asset categorization to determine the proper scoping for the organization.
  B. Stop the assessment.
  C. Advise the OSC to conduct another scoping exercise that covers all assets.
  D. Require the OSC to refine its security boundaries to include all assets that come into contact with CUI.
  A. Review the OSC's environment and asset categorization to determine the proper scoping for the organization.

• Question 256:

  During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can provide a preliminary score before the assessment is complete to help prioritize remediation efforts. What should the Lead Assessor do?

  A. Provide a preliminary score based on the evidence reviewed so far.
  B. Politely refuse, explaining that scores are only finalized after all evidence is assessed per the CMMC Assessment Process.
  C. Offer to provide a general indication of compliance without specific scores.
  D. Agree to provide the score but only after consulting with the C3PAO.
  B. Politely refuse, explaining that scores are only finalized after all evidence is assessed per the CMMC Assessment Process.

• Question 257:

  A CCA who works for a C3PAO doubles as a penetration tester. When conducting a CMMC assessment for an OSC, he realizes their cybersecurity practices are lacking. Recognizing potential vulnerabilities in their systems, the CCA approaches the OSC's cyber team and offers his penetration testing services. Which CoPC guiding principle or practice has the CCA failed to live up to?

  A. Assurance
  B. Conflict of Interest
  C. Professionalism
  D. Confidentiality
  C. Professionalism

• Question 258:

  You are assessing an organization's implementation of the System and Information Integrity (SI) practices. During your assessment, you find that the organization has subscribed to security alert and advisory services from reputable sources, such as US- CERT and relevant industry-specific organizations. In interviews with their network and system administrators, you learn that they have deployed an intrusion detection system (IDS) to monitor network traffic for known threats and suspicious activities. They also have a Security Information and Event Management (SIEM) system in place to aggregate and analyze logs from various sources for potential security incidents. Additionally, the network administrator informs you that they have established a Security Operations Center (SOC) to monitor and analyze activity on networks, servers, databases, applications, and other systems. However, you notice that while the organization receives these alerts and advisories, there is no documented process or assigned personnel responsible for reviewing and acting upon them. After reviewing the organization's implementation, which of the following would be the most appropriate next step for the assessor to validate compliance with CMMC practice SI.L2-3.14.3 ?Security Alertsand; Advisories?

  A. Test the organization's processes for defining, receiving, and disseminating security alerts and advisories
  B. Examine the organization's system and information integrity policies and procedures
  C. Review system audit logs and records for evidence of actions taken in response to security alerts and advisories
  D. Interview the personnel responsible for the Security Operations Center (SOC) to determine whether they take actions in response to security alerts and advisories
  D. Interview the personnel responsible for the Security Operations Center (SOC) to determine whether they take actions in response to security alerts and advisories

• Question 259:

  A CCA is assessing an Organization Seeking Certification (OSC). During the assessment, they discover that the OSC is pressuring the CCA to overlook certain security practices that do not meet the CMMC requirements. The organization threatens to withhold payment if the CCA does not modify her findings at the request of the OSC. According to the CoPC, which of the followingactions would be most appropriate for the CCA to take in this situation?

  A. Inform the OSC that the pressure to compromise her values is a violation of the CoPC and report the issues to the C3PAO.
  B. Complete the assessment and then report the OSC's unethical practices to the Cyber AB.
  C. Comply with the organization's requests to avoid the risk of non-payment and complete the assessment.
  D. Discuss the concerns with the OSC, continue the assessment, and report the violations only if they are not resolved.
  A. Inform the OSC that the pressure to compromise her values is a violation of the CoPC and report the issues to the C3PAO.

• Question 260:

  Jane is a CCA for a leading C3PAO. She is selected to be part of a team of four, headed by James, to assess how Micron Inc., an OSC, has implemented the requirements for a CMMC Level 2 certification. However, she witnesses James striking a deal with Micron's CISO to manipulate some findings to ensure the OSC is certified. What should Jane do?

  A. Assume nothing happened and continue with the assessment.
  B. Privately request clarification from James.
  C. Ask for a bribe from James to keep quiet.
  D. Contact the DoD CIO and report James.
  B. Privately request clarification from James.