Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 271:

  The Assessment Kickoff meeting is one of the most important sessions of any CMMC Assessment engagement.

  All the following are participants in this meeting, EXCEPT?

  A. Members of the OSC that will be providing evidence.
  B. The Lead Assessor.
  C. The OSC PoC.
  D. The CMMC Quality Assurance Professional (CQAP).
  D. The CMMC Quality Assurance Professional (CQAP).

• Question 272:

  An OSC can use either of the following strategies to meet the requirements of CMMC practice MP.L2-3.8.8

  - Shared Media, EXCEPT?

  A. Permitting unrestricted use of portable storage devices after users complete security awareness training
  B. Ensuring every portable storage device is assigned an owner, project, or department with an identifiable label or registered in a central database
  C. Implementing strong access controls that only allow registered devices to connect to the system
  D. Implementing a strict usage policy that allows for the use of owned portable or owned storage devices
  A. Permitting unrestricted use of portable storage devices after users complete security awareness training

• Question 273:

  You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery.

  How will proper separation of duties help the contractor meet the intent of AC.L2-3.1.4 - Separation of Duties?

  A. It allows the engineers to specialize in specific areas
  B. It reduces concentrated privileges and power and improves checks & balances. Errors and malicious actions are more likely to be caught. Risk is reduced without relying solely on one individual
  C. It reduces the overall cost of software development
  D. It simplifies the development process
  B. It reduces concentrated privileges and power and improves checks & balances. Errors and malicious actions are more likely to be caught. Risk is reduced without relying solely on one individual

• Question 274:

  As a CCA, you were the Lead Assessor for a C3PAO Assessment Team that has just completed a CMMC assessment for an OSC. However, an individual has requested under the FOIA that your C3PAO release the assessment results.

  As the Lead Assessor, your C3PAO wants to hear your views on this request.

  What should your recommendation be?

  A. Release a redacted version of the assessment results.
  B. Refer the FOIA request to the CMMC Accreditation Body for guidance and a decision on whether to release the assessment results.
  C. Release the full assessment results.
  D. Deny the request and do not release any assessment information.
  D. Deny the request and do not release any assessment information.

• Question 275:

  You are assessing a contractor's implementation for CMMC practice MA.L2-3.7.4 - Media Inspection by examining their maintenance records. You realize the maintenance logs identify a repeating problem. A recently installed central server has been experiencing issues affecting the performance of the contractor's information systems. This is confirmed by your interview with the contractor's IT team. You requested to investigate the server, and the IT team agreed. On the server, there is a file named conf.zip that gets your attention. You decide to open the file in an isolated computer for further review.

  To your surprise, the file is a .exe used when testing the server for data exfiltration.

  How should this incident be handled?

  A. By immediately reporting it to the FBI's Cyber Division
  B. Decommissioning the server and installing a new one
  C. In accordance with the incident response plan
  D. By sandboxing the malicious code and continuing with business as usual
  C. In accordance with the incident response plan

• Question 276:

  When assessing a contractor's implementation of CMMC requirements, you realize they have multiple data centers and regional offices, each having its access control mechanisms and security perimeter. The contractor uses a remote access solution to allow external partners and employees to collaborate on projects that involve CUI. The solution requires routing configuration to ensure the remote access to CUI is not compromised.

  In assessing the contractor's implementation of AC.L2-3.1.14 - Remote Access Routing, what must you determine?

  A. The contractor manages access control points
  B. Managed access control points are identified, implemented, and remote access is routed through these managed network access control points
  C. All remote access is monitored
  D. All users are authenticated before being granted remote access
  B. Managed access control points are identified, implemented, and remote access is routed through these managed network access control points

• Question 277:

  An OSC specializing in developing directed energy systems plans to bid on a DoD contract to produce a 250kW High Energy Laser Weapon System (HELWS). This system is to be deployed on military bases across the globe to protect U.S. servicemen against aerial threats, including mortars, rockets, and unmanned aerial vehicles (UAVs), as well as swarms of mini-UAVs. Because of the sensitivity of the information, the OSC has prohibited using emails to transmit information regarding the project, whether encrypted or otherwise. They also have instituted procedures to remove CUI from the email system.

  What CMMC assessment requirements must the Assessment Team follow regarding the OSC's email system?

  A. Since there are measures in place to prevent CUI transfer through email, the email system is out of scope and there is no need to assess it against CMMC practices.
  B. The Assessment Team must assess the email system against all CMMC practices.
  C. Review the SSP in accordance with practice CA.L2-3.12.4 - System Security Plan.
  D. Review the SSP in accordance with CA.L2-3.12.4 - System Security Plan and assess against other CMMC practices.
  C. Review the SSP in accordance with practice CA.L2-3.12.4 - System Security Plan.

• Question 278:

  While onsite conducting a CMMC Level 2 assessment at a small architecture firm that handles DoD construction contracts, the client offers a list of personnel for interviews.

  To answer questions regarding visitor access controls, which personnel would be MOST appropriate for interviewing?

  A. System Administrator
  B. Front-desk Receptionist
  C. Administrative Assistant
  D. Senior Architecture Partner
  B. Front-desk Receptionist

  ---

  Explanation

  Visitor access control (PE.L2-3.10.3 and PE.L2-3.10.4) typically involves procedures at entry points. The front-desk receptionist is the staff member most directly involved in logging, controlling, and monitoring visitor access. While system admins and partners handle IT and business operations, they do not control physical visitor access day-to-day.

  Exact extracts:

  "Assessment Method - Interview: personnel responsible for visitor access control (e.g., reception staff, security desk staff)." "Assessment Objectives... Determine if visitor access is identified, logged, escorted, and monitored."

  Why the other options are incorrect:

  Option A: System admins focus on IT, not visitor management.

  Option C: Administrative assistants generally perform clerical tasks, not visitor logging.

  Option D: Senior partners may approve contracts but are not directly responsible for visitor control.

  CMMC Assessment Guide - Level 2, PE.L2-3.10.3 & PE.L2-3.10.4.

• Question 279:

  You are the CCA working with a client to deliver certified consulting services, and the OSC has asked how to ensure their scope is accurate. You mention the use of a data flow diagram, which intrigues the OSC.

  What would be the first step in constructing the data flow diagram for the OSC?

  A. Implement a Data Loss Prevention (DLP) tool to monitor data flows within the OSC
  B. Conduct interviews with key stakeholders to understand the organization's business processes
  C. Identify how data flows through the OSC's business, including systems, subprocesses, and data stores, identifying major inputs and outputs to the environment
  D. Gather information about the OSC's network infrastructure and create a network diagram
  C. Identify how data flows through the OSC's business, including systems, subprocesses, and data stores, identifying major inputs and outputs to the environment

• Question 280:

  During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team.

  Can the Lead Assessor proceed with the assessment using a reduced assessment team size?

  A. Yes, as long as the remaining team members possess the necessary qualifications to cover all CMMC practices.
  B. Yes, but only with the express written consent of the Cyber AB.
  C. The decision is solely up to the OSC.
  D. No, the assessment must be postponed until the full team is available.
  A. Yes, as long as the remaining team members possess the necessary qualifications to cover all CMMC practices.