Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 281:

  An assessor is trying to determine if an OSC performs scans of their information system and real-time scans of files from external sources as files are downloaded or executed.

  Which evidence is LEAST LIKELY to help this assessor?

  A. System configuration settings
  B. System Information and Integrity Policy
  C. Alerts from the anti-virus software
  D. Interviews with personnel with configuration management responsibility
  B. System Information and Integrity Policy

  ---

  Explanation

  To verify scanning (such as anti-virus and file integrity functions), the strongest evidence includes system configurations, AV alerts/logs, and interviews with technical staff. A policy document (System Information and Integrity Policy) provides intent but not actual implementation proof, making it the least helpful.

  Extract:

  "Policies provide documented intent, but assessors must validate actual implementation through configuration reviews, alerts/logs, and personnel interviews."

  Thus, the policy alone is the least useful evidence for confirming scans are actually performed.

  References:

  CMMC Assessment Guide - Level 2, SI.L2-3.14.x.

• Question 282:

  After numerous discussions and iterations, the OSC and Lead Assessor have finalized the Pre-Assessment Plan, which outlines the key details of how the assessment will be conducted, including the scope, timeline, resource requirements, and other logistical considerations.

  What is the final step before commencing a CMMC assessment?

  A. Obtaining approval from the Lead Assessor.
  B. Reviewing the Pre-Assessment Data Form.
  C. Uploading the Pre-Assessment Data Form into CMMC eMASS.
  D. Creating a new data upload in CMMC eMASS.
  C. Uploading the Pre-Assessment Data Form into CMMC eMASS.

• Question 283:

  Security Protection Assets (SPAs) include people, technologies, and facilities.

  Which of the following technologies is not an SPA?

  A. Hosted VPN Services
  B. Virtualized desktops
  C. Cloud-based security solutions
  D. SIEM Solutions
  B. Virtualized desktops

• Question 284:

  An OSC is preparing for a CMMC assessment. It has multiple information systems, some of which process CUI and others that do not. The OSC has identified a specific system that processes CUI and defined this as its system boundary. However, this system is connected to other systems within the OSC that are separately authorized and do not process CUI.

  As a Certified CMMC Assessor, which of the following best describes your approach to defining the CMMC Certification Boundary and Assessment Scope for the OSC?

  A. The CMMC Certification Boundary and Assessment Scope should include all information systems within the organization, regardless of whether they process CUI or not.
  B. The CMMC Certification Boundary and Assessment Scope should only include the specific system that processes CUI and exclude all other systems.
  C. The CMMC Certification Boundary should include the specific system that processes CUI, while the Assessment Scope should encompass all systems within the OSC.
  D. The CMMC Certification Boundary should include the specific system that processes CUI. In contrast, the Assessment Scope should consist of all components of the information system that require authorization and excludes separately authorized systems to which the information system is connected.
  D. The CMMC Certification Boundary should include the specific system that processes CUI. In contrast, the Assessment Scope should consist of all components of the information system that require authorization and excludes separately authorized systems to which the information system is connected.

• Question 285:

  SecureLogic Inc. is a cybersecurity consulting firm that provides managed security services to various defense contractors. During a CMMC assessment of one of their clients, the Lead Assessor finds that SecureLogic Inc. has provided evidence supporting several inherited practices related to incident response and vulnerability management.

  Which of the following actions should the Lead Assessor take?

  A. Automatically score the inherited practices as 'MET' based on SecureLogic Inc.'s evidence.
  B. Score the inherited practices as 'NOT MET' and require the client to implement them internally, regardless of SecureLogic Inc.'s evidence.
  C. Recommend that the client implement the inherited practices internally, as inheriting them from external service providers is not allowed.
  D. Evaluate the evidence provided by SecureLogic Inc. to ensure it meets the assessment objectives for the inherited practices and is applicable to the client's in-scope assets.
  D. Evaluate the evidence provided by SecureLogic Inc. to ensure it meets the assessment objectives for the inherited practices and is applicable to the client's in-scope assets.

• Question 286:

  You have been sent to assess an OSC's implementation of CMMC practices, one of which is AC.L2-3.1.11

  - Session Termination.

  You expect to find the following items when examining the contractor's list of conditions or trigger events requiring session termination, EXCEPT?

  A. Time-of-day restrictions on system use
  B. Organization-defined periods of user inactivity
  C. Pre-approved user activity for specific functionalities
  D. Targeted responses to certain types of incidents
  C. Pre-approved user activity for specific functionalities

• Question 287:

  During your on-site assessment, you examine an OSC's network architecture and the components that make up its defined security boundary. You notice various network devices, servers, and endpoints that are considered part of the OSC's information system. Additionally, the design team also uses a 3D printer to produce model prototypes.

  Which of the following is not a boundary component?

  A. The virtualization systems
  B. The 3D printer
  C. The router
  D. The gateway
  B. The 3D printer

• Question 288:

  You are conducting a CMMC assessment for a contractor that develops software applications for the DoD.

  During the assessment of the AU domain, you request to examine the contractor's audit and accountability policies, access control procedures, and system configuration documentation related to the management of audit logging functionality. Upon reviewing the documentation, the contractor has implemented a Role-Based Access Control (RBAC) model, where privileged users are assigned different roles based on their responsibilities. One of these roles is the "Audit Administrator" role, which is granted the necessary privileges to manage audit logging functionality across the contractor's systems. However, during interviews with the system administrators, you learn that besides the Audit Administrator role, several other privileged roles, such as the "System Administrator" and "Network Administrator" roles, can also manage audit logging functionality. When you inquire about the rationale behind granting multiple privileged roles access to audit management functions, the contractor's security team explains that this approach allows for better operational flexibility and ensures that different teams can perform audit logging tasks based on their areas of responsibility.

  Based on the information provided in the scenario, how would you assess the contractor's compliance with CMMC practice AU.L2- 3.3.9 - Audit Management?

  A. Partially Met -The contractor has limited audit management privileges to a subset of privileged users, but the roles may not be appropriately defined
  B. Met -The contractor has defined privileged user roles for audit management
  C. Not Applicable -The practice is not relevant to the contractor's environment
  D. Not Met -The contractor has granted audit management privileges to multiple privileged roles, which goes against the requirement to limit access to a subset of defined privileged users
  D. Not Met -The contractor has granted audit management privileges to multiple privileged roles, which goes against the requirement to limit access to a subset of defined privileged users

• Question 289:

  After the Assessment Team has been formed and the OSC Point of Contact (PoC) and Assessment Official have been identified, your C3PAO appoints John as the Lead Assessor. During the kickoff meeting, John reassures the OSC Assessment Official not to worry; they are guaranteed to pass the

  CMMC assessment. If they don't, John has agreed to refund 40% of the assessment fee.

  Which of the following is true about John's behavior as a Certified CMMC Assessor?

  A. It is unprofessional.
  B. It is acceptable as it incentivizes the OSC to cooperate fully during the assessment process.
  C. It aligns with the principle of objectivity outlined in the Code of Professional Conduct by removing any potential conflict of interest.
  D. It demonstrates his confidence in the Assessment Team's abilities and the OSC's preparedness.
  A. It is unprofessional.

• Question 290:

  During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can provide a preliminary score before the assessment is complete to help prioritize remediation efforts.

  What should the Lead Assessor do?

  A. Provide a preliminary score based on the evidence reviewed so far.
  B. Politely refuse, explaining that scores are only finalized after all evidence is assessed per the CMMC Assessment Process.
  C. Offer to provide a general indication of compliance without specific scores.
  D. Agree to provide the score but only after consulting with the C3PAO.
  B. Politely refuse, explaining that scores are only finalized after all evidence is assessed per the CMMC Assessment Process.