Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 271:

  A C3PAO Assessment Team has completed assessing an OSC's implementation of the CMMC practices. They are now in the process of archiving the assessment artifacts as per the CAP. However, the OSC informed the Assessment Team that they could not take the artifacts offsite even after completing the assessment. The Assessment Team is concerned that the OSC may change the assessment artifacts, compromising their integrity. What should the Assessment Team recommend that the OSC do to protect the confidentiality and integrity of the Assessment Artifacts?

  A. Hash the assessment artifacts to create unique digital fingerprints for record-keeping purposes.
  B. Temporarily copy the artifacts to secure portable storage devices for offsite review and return them afterwards.
  C. Request the OSC to provide redacted versions of the artifacts for offsite review.
  D. Take photographs of the artifacts using their personal devices for later reference.
  A. Hash the assessment artifacts to create unique digital fingerprints for record-keeping purposes.

• Question 272:

  Jane is a CCA for a leading C3PAO. She is selected to be part of a team of four, headed by James, to assess how Micron Inc., an OSC, has implemented the requirements for a CMMC Level 2 certification. However, she witnesses James striking a deal with Micron's CISO to manipulate some findings to ensure the OSC is certified. What should Jane do?

  A. Assume nothing happened and continue with the assessment.
  B. Privately request clarification from James.
  C. Ask for a bribe from James to keep quiet.
  D. Contact the DoD CIO and report James.
  B. Privately request clarification from James.

• Question 273:

  SecureNet is a mid-sized company that designs and manufactures access control systems for government buildings. These systems utilize Internet of Things (IoT) devices embedded within the access control panels for real-time remote monitoring. SecureNet is undergoing a CMMC Level 2 assessment to comply with new government contracting requirements. During the scope validation stage, the Certified CMMC Assessor (CCA) will review SecureNet's proposed assessment scope with the IT team. The scope includes all servers, workstations, and laptops within SecureNet's network. However, there is no mention of the IoT devices within the access control panels. Which of the following asset categories is most likely to encompass the in-scope IoT devices used in SecureNet's access control systems?

  A. Security Protection Asset (SPA)
  B. Specialized Assets
  C. Hardware Assets
  D. Contractor Risk Managed Asset (CRMA)
  B. Specialized Assets

• Question 274:

  CMMC practice PS.L2-3.9.1 ?Screen Individuals requires individuals to be screened before authorizing access to organizational systems containing CUI. However, in the assessment you are currently conducting, there is no physical evidence confirming the completion of personnel screens, such as background checks, only affirmations derived from an interview session. In an interview with the HR Manager, they informed you that before an individual is hired, they submit their information through a service that performs criminal and financial checks. How would you score the OSC's implementation of CMMC practice PS.L2-3.9.1 ?Screen Individuals, objective [a]?

  A. More information is needed
  B. Not Met
  C. Not Applicable
  D. Met
  A. More information is needed

• Question 275:

  A C3PAO and OSC have agreed to proceed with CMMC assessment planning. The OSC assessment official and the C3PAO are working to determine the planning details and purview of the Assessment, which includes scoping. When should the C3PAO and OSC conduct the high-level contract framing?

  A. After the C3PAO has assigned the Lead Assessor and Assessment Team.
  B. At the beginning of their engagement for the CMMC assessment.
  C. During Phase 2 of the CMMC assessment process.
  D. After the OSC has determined the CMMC Assessment Scope.
  B. At the beginning of their engagement for the CMMC assessment.

• Question 276:

  You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. During the assessment, you find that the OSC has failed to meet the requirements for CMMC practice AU.L2-3.3.4 ?Audit Failure Alerting. According to the CMMC Assessment Process (CAP), which of the following should be your next step?

  A. Immediately stop the assessment and report the failure to the C3PAO.
  B. Mark the practice as "NOT MET" in the final assessment report without further action.
  C. Provide the OSC with a specific timeframe to remediate the failed practice.
  D. Evaluate the failed practice against the DoD Assessment Methodology and CMMC 2.0 POAandM scoring criteria.
  D. Evaluate the failed practice against the DoD Assessment Methodology and CMMC 2.0 POAandM scoring criteria.

• Question 277:

  You are part of the Assessment Team evaluating an OSC's implementation of AC.L2- 3.1.13 ?Remote Access Confidentiality. This requirement mandates the organization to employ cryptographic mechanisms to protect the confidentiality of remote access sessions. During your assessment, you want to determine whether these cryptographic mechanisms have been properly identified as required by assessment objective [a]. What specification can you use to make this determination?

  A. Interviews with security administrators
  B. Interviews of personnel responsible for remote access
  C. Remote access authorizations
  D. The organization's Access Control Policy and Procedures and system design documentation
  D. The organization's Access Control Policy and Procedures and system design documentation

• Question 278:

  A Defense Contractor is preparing for their upcoming CMMC Level 2 assessment. One of the key controls they need to address is CMMC practice MP.L2-3.8.5 ?Media Accountability, which deals with maintaining accountability for media containing CUI during transport outside of controlled areas. The organization regularly needs to transport physical media, such as hard drives and backup tapes, between their primary data center and an off-site storage facility. In the past, they have simply used standard packaging and commercial shipping services to move this media. Which of the following is NOT an assessment method for MP.L2-3.8.5 ?Media Accountability?

  A. Testing mechanisms supporting or implementing media storage and media protection
  B. Examining designated controlled areas
  C. Interviewing organizational processes for storing media
  D. Examining procedures addressing media storage and access control policy
  C. Interviewing organizational processes for storing media

• Question 279:

  Documentation is a key aspect of the CMMC assessment. When preparing for a prospective assessment and during the actual CMMC assessment, you will reference various documents and document various findings. Fortunately, you can download some of these documents from the DoD CIO's CMMC website, and other templates can be found in the CAP Appendices. You are part of the team assessing an OSC's preparedness and readiness for a CMMC assessment. Which document/template includes the OSC's evidence, assets, and CMMC assessment scope, among other data?

  A. CMMC Assessment In-Brief
  B. The OSC Data Form
  C. CMMC Assessment Findings Briefing
  D. CMMC Pre-Assessment Form Template
  D. CMMC Pre-Assessment Form Template

• Question 280:

  After completing a CMMC assessment, the OSC should hash all the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide. However, you have just realized that this requirement was not fulfilled, and the OSC Assessment Official cannot be reached to confirm it was done. To avoid any issues, you quickly complete this step and later inform the OSC Assessment Official. Which CoPC principle have you just violated by hashing the evidence artifacts in place of the OSC?

  A. Professionalism
  B. Confidentiality
  C. Objectivity
  D. Information Integrity
  D. Information Integrity