Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 21:

  During a CMMC Level 2 assessment, a CCA is evaluating whether the organization meets the requirement to "Employ FIPS-validated cryptography when used to protect the confidentiality of CUI." According to the CMMC requirement, the CCA must determine whether FIPS-validated cryptography is employed to protect the confidentiality of CUI.

  Which assessment procedure would the CCA most likely use to evaluate this requirement?

  A. Examine the cryptographic modules
  B. Interview personnel responsible for implementing cryptographic controls and review documentation of the organization's cryptographic policies and procedures
  C. Observe the organization's use of cryptographic controls in practice
  D. Examine validation certificates of the cryptographic modules used by the OSC
  D. Examine validation certificates of the cryptographic modules used by the OSC

• Question 22:

  While assessing a company, the CCA is determining whether the company controls and manages connections between its corporate network and all external networks.

  The company has:

  (1) a strict employee policy prohibiting personal Internet use and personal email on company computers, and (2) firewalls plus a connection allow-list so only authorized external networks can connect to the company network.

  Are these safeguards sufficient to meet the applicable CMMC requirement?

  A. Yes. The company's strict employee policy is the best practice for meeting the requirement.
  B. No. The company must isolate its system from all external connections to meet the requirement.
  C. Yes. The company's firewalls and connection allow-lists are appropriate technical controls to meet the requirement.
  D. No. The company needs full control over all external systems it interfaces with to meet the requirement.
  C. Yes. The company's firewalls and connection allow-lists are appropriate technical controls to meet the requirement.

  ---

  Explanation

  Applicable CMMC/NIST Requirement: AC.L2-3.1.20 -"Verify and control/limit connections to and use of external systems."

  Isolation Not Required (refutes B): The requirement acknowledges that individuals using external systems (e.g., contractors, partners) may need to access organizational systems. In such cases, organizations must ensure those connections do not compromise or harm organizational systems. Therefore, complete isolation from all external systems is not mandated.

  Policy Alone is Insufficient (refutes A): Assessment guidance requires mechanisms that technically enforce terms and conditions for use of external systems. A written employee policy by itself does not satisfy the requirement unless paired with technical enforcement (e.g., firewalls, connection rules).

  Allow-lists & Firewalls are Best Practice (supports C): Assessment considerations specify that organizations should restrict external systems to an approved list, such as by using firewalls, VPNs, IP restrictions, or certificates. The company's use of firewalls and a connection allow-list directly addresses this requirement.

  Full Control of External Systems Not Required (refutes D): The definition of "external systems" clarifies that organizations typically do not have direct supervision or authority over those systems. The requirement is to limit and control connections to such systems, not to own or fully manage them.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - 3.1.20 (Discussion)

  NIST SP 800-171A - 3.1.20 (Assessment Objectives & Methods) CMMC Assessment Guide - Level 2, Version 2.13 - AC.L2-3.1.20 (External Connections [CUI Data], including "Potential Assessment Considerations")

• Question 23:

  Understanding that changes are critical in any production environment, a DoD contractor has instituted measures to manage them. All software changes can only be implemented by defined individuals. These changes must have gone through a rigorous change approval process and must be implemented from a secure server located in the company's headquarters. The personnel affecting the changes access the server room using access cards and an iris scan. To log into the server, they must enter their passwords to receive a one-time password (OTP), which must be keyed in within 2 minutes. After any changes are made, the chairperson of the contractor's Change Review Board and the CISO get a notification to approve the changes before they take effect.

  To determine if the contractor has implemented enough measures to meet CM.L2-3.4.5 - Access Restrictions for Change, you need to examine all the following EXCEPT?

  A. Procedures addressing access restrictions for changes to the system
  B. Plan of Action and Milestones
  C. Contractor's configuration management policy
  D. System architecture and configuration documentation
  B. Plan of Action and Milestones

• Question 24:

  Jane is a CCA leading a CMMC assessment for an OSC. During the evaluation, Jane discovers that the OSC's Chief Information Security Officer (CISO) is a former colleague with whom she had a contentious relationship in the past. Unbeknownst to the OSC, Jane still harbors resentment toward the CISO due to their previous conflicts. As the assessment progresses, Jane becomes increasingly critical of the CISO's security practices, scrutinizing every detail and finding fault despite the OSC's best efforts to demonstrate compliance.

  Given this scenario, how can a Certified CMMC Assessor's personal bias impact the assessment of the OSC?

  A. Assessor bias has no effect on the assessment process and outcomes
  B. Assessor bias is not a concern in CMMC assessments
  C. Personal bias may result in an unfairly harsh and critical assessment of the OSC
  D. Assessor bias can lead to an overly lenient evaluation of the OSC
  C. Personal bias may result in an unfairly harsh and critical assessment of the OSC

• Question 25:

  During your review of an OSC's system security control, you focus on CMMC practice SC.L2-3.13.9 - Connections Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network. The server operating system utilizes default settings for connection timeouts. Network security is managed through a centralfirewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, there is no documented policy or procedure outlining a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work. The scenario describes using a central firewall for network security.

  How could the firewall be configured to help achieve the objectives of CMMC practice SC.L2-3.13.9 - Connections Termination, for the remote access application?

  A. Creating firewall rules to identify and terminate connections associated with the CUI access application that have been inactive for a predefined period
  B. Encrypting all traffic between the user device and the server to protect CUI in transit
  C. Implementing intrusion detection and prevention systems (IDS/IPS) to identify and block suspicious activity on the server
  D. Blocking all incoming traffic to the server hosting the CUI access application, except from authorized IP addresses
  A. Creating firewall rules to identify and terminate connections associated with the CUI access application that have been inactive for a predefined period

• Question 26:

  As the Lead Assessor conducting a CMMC Level 2 assessment for an OSC, the Assessment Team has thoroughly reviewed all evidence provided by the OSC for the in-scope CMMC practices. Throughout the assessment process, daily checkpoint meetings were held with the OSC to allow them to present additional evidence and clarify any concerns. After the final evidence review and discussions, the Assessment Team has determined that 92 out of the 110 CMMC Level 2 practices have been scored as MET. Additionally, 18 practices have been scored as NOT MET, with 5 of those practices deemed ineligible for a Plan of Action and Milestones (POA&M) due to their potential impact on network exploitation or CUI exfiltration. The OSC has provided a draft POA&M for the remaining 13 NOT MET practices, outlining their proposed remediation actions and timelines. In reviewing the OSC's draft POA&M, you notice that one of the proposed remediation actions involves implementing a new security control that could potentially impact the effectiveness of another practice that was scored as MET.

  How should you proceed?

  A. Note the concern but allow the POA&M to proceed, as the impact on other practices can be reassessed during the next CMMC assessment.
  B. Accept the POA&M as it is, provided that the proposed remediation timelines are reasonable.
  C. Request the OSC to revise the POA&M, removing any actions that could limit the effectiveness of practices scored as `MET.'
  D. Reject the entire POA&M and require the OSC to resubmit it with all necessary corrections.
  C. Request the OSC to revise the POA&M, removing any actions that could limit the effectiveness of practices scored as `MET.'

• Question 27:

  Sarah, a Certified CMMC Assessor, is conducting an assessment for DataSecure, a cloud service provider that hosts various applications for the Defense Industrial Base (DIB). During the assessment, Sarah encounters a complex and highly specialized cloud architecture that leverages cutting-edge technologies such as containerization, serverless computing, and advanced security controls. As Sarah reviews the evidence provided by DataSecure for the relevant CMMC practices, she realizes that some of the evidence and implementations are unlike anything she has encountered in previous assessments.

  What is the most appropriate action for Sarah to take as a CCA in this scenario?

  A. Request DataSecure to simplify their architecture and align with more traditional IT practices for easier evaluation.
  B. Strictly adhere to a standardized assessment checklist, regardless of DataSecure's unique architecture.
  C. Defer the assessment until she can receive additional training on the specific technologies used by DataSecure.
  D. Thoroughly research and understand DataSecure's cloud architecture, seek clarification from subject matter experts, and evaluate the evidence within the context of their specialized environment.
  D. Thoroughly research and understand DataSecure's cloud architecture, seek clarification from subject matter experts, and evaluate the evidence within the context of their specialized environment.

• Question 28:

  A company is undergoing a CMMC Level 2 Assessment. During the Conduct Assessment phase, an Assessment Team member is reviewing the policies and procedures in the incident response plan.

  Which assessment method is being utilized?

  A. Test
  B. Examine
  C. Interview
  D. Observation
  B. Examine

  ---

  Explanation

  The Examine method is used when the assessor reviews documents, policies, procedures, or system artifacts to validate practices.

  Extract:

  "Examine: Review, inspect, or analyze assessment objects such as documents, records, and policies to determine compliance with practice requirements." Reviewing the incident response plan falls directly under Examine.

  References:

  CMMC Assessment Process (CAP) Assessment Methods.

• Question 29:

  John, a CCA, has been assigned by his C3PAO to conduct a CMMC assessment for an OSC. During the assessment, John notices that the OSC's security practices leave much to be desired. After speaking with the OSC's IT staff, John offers to connect them with a vendor he knows who sells a vulnerability management tool that could address some of their weaknesses.

  According to the CMMC CoPC, which of the following best describes John's actions?

  A. John acted appropriately by trying to help the OSC improve its security posture.
  B. John did not show respect for intellectual property.
  C. John's actions were deemed acceptable since he did not directly profit from connecting the OSC with the vendor.
  D. John violated the principles of professionalism and objectivity by soliciting business for a third-party vendor while serving on the Assessment Team.
  D. John violated the principles of professionalism and objectivity by soliciting business for a third-party vendor while serving on the Assessment Team.

• Question 30:

  After the Assessment Team has been formed and the OSC Point of Contact (PoC) and Assessment Official have been identified, your C3PAO appoints John as the Lead Assessor. During the kickoff

  meeting, John reassures the OSC Assessment Official not to worry; they are guaranteed to pass the

  CMMC assessment. If they don't, John has agreed to refund 40% of the assessment fee.

  Which of the following is true about John's behavior as a Certified CMMC Assessor?

  A. It is unprofessional.
  B. It is acceptable as it incentivizes the OSC to cooperate fully during the assessment process.
  C. It aligns with the principle of objectivity outlined in the Code of Professional Conduct by removing any potential conflict of interest.
  D. It demonstrates his confidence in the Assessment Team's abilities and the OSC's preparedness.
  A. It is unprofessional.