Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 291:

  As a Certified CMMC Assessor, you are part of a team assessing a small defense contractor. During the assessment, an employee being interviewed appears unsure about some security practices and asks for your advice on how to answer certain questions to make their compliance appear better. As a Certified CMMC Assessor, what should you do in this situation?

  A. Suggest that they seek guidance from another Assessor.
  B. Offer to create documentation to cover gaps in their compliance.
  C. Politely refuse to provide any assistance and continue the assessment as planned.
  D. Provide guidance on how to answer questions to maximize the appearance of compliance.
  C. Politely refuse to provide any assistance and continue the assessment as planned.

• Question 292:

  You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. Which of the following is not one of the recommended methods for collecting evidence during a CMMC assessment?

  A. Examine
  B. Self-Assessment by the OSC
  C. Interview
  D. Test
  B. Self-Assessment by the OSC

• Question 293:

  When assessing a contractor's implementation of CMMC requirements, you realize they have multiple data centers and regional offices, each having its access control mechanisms and security perimeter. The contractor uses a remote access solution to allow external partners and employees to collaborate on projects that involve CUI. The solution requires routing configuration to ensure the remote access to CUI is not compromised. In assessing the contractor's implementation of AC.L2-3.1.14 ?Remote Access Routing, what must you determine?

  A. The contractor manages access control points
  B. Managed access control points are identified, implemented, and remote access is routed through these managed network access control points
  C. All remote access is monitored
  D. All users are authenticated before being granted remote access
  B. Managed access control points are identified, implemented, and remote access is routed through these managed network access control points

• Question 294:

  CMMC practice PS.L2-3.9.1 ?Screen Individuals requires individuals to be screened before authorizing access to organizational systems containing CUI. However, in the assessment you are currently conducting, there is no physical evidence confirming the completion of personnel screens, such as background checks, only affirmations derived from an interview session. In an interview with the HR Manager, they informed you that before an individual is hired, they submit their information through a service that performs criminal and financial checks. How would you score the OSC's implementation of CMMC practice PS.L2-3.9.1 ?Screen Individuals, objective [a]?

  A. More information is needed
  B. Not Met
  C. Not Applicable
  D. Met
  A. More information is needed

• Question 295:

  Angela, a CCA, is conducting a CMMC assessment for Obsidian Technologies, the OSC. Duringthe assessment, Angela learns that her spouse owns a significant amount of stock in Obsidian Technologies, and she has not disclosed this information to Obsidian Technologies or the C3PAO. Which CMMC CoPC guiding principle has Angela violated in this scenario?

  A. Objectivity
  B. Impartiality
  C. Adherence to Materials and Methods
  D. Confidentiality
  A. Objectivity

• Question 296:

  An OSC has recently obtained an ISO 27001 certification and a FedRAMP Authorization to Operate (ATO) for its information systems. During the initial stages of the CMMC Assessment Process, the OSC claims that these certifications should grant them automatic credit or exemption from certain CMMC requirements. As the Lead Assessor, what should be your response?

  A. Proceed with the CMMC Assessment as planned, disregarding the OSC's claim about their ISO 27001 and FedRAMP certifications.
  B. Request the OSC to provide evidence of their ISO 27001 and FedRAMP certifications and then consult with the CMMC Accreditation Body to determine if any credit or exemption can be granted.
  C. Accept the OSC's claim and grant them appropriate credit or exemption based on their ISO 27001 and FedRAMP certifications.
  D. Inform the OSC that their ISO 27001 and FedRAMP certifications do not bestow any status or credit towards their CMMC assessment or certification.
  D. Inform the OSC that their ISO 27001 and FedRAMP certifications do not bestow any status or credit towards their CMMC assessment or certification.

• Question 297:

  A C3PAO has hired a full-time CCA and included them in an Assessment Team sent to conduct a CMMC assessment. However, as part of their agreement with Cyber AB, the CCA and, by extension, the C3PAO are expected to uphold a set of values during the assessment. What document sets the expectations for accredited and credentialed entities authorized to deliver CMMC services under Cyber AB licensing?

  A. Code of Professional Control
  B. CMMC Code of Professional Conduct
  C. CMMC Code of Ethical Conduct
  D. Code of Ethical Conduct
  B. CMMC Code of Professional Conduct

• Question 298:

  You are a CCA conducting a CMMC assessment for an OSC. While evaluating Risk Assessment (RA) practices, you check how the OSC has addressed assessment objective [a] of RA.L2-3.11.1, "Determine if the frequency for assessing risk to organizational operations, organizational assets, and individuals is defined." Which Assessment Object would most likely provide the answer to this requirement?

  A. Risk Assessment Policy
  B. Plan of Actions
  C. Risk Assessment Report
  D. Vulnerability scanning results
  A. Risk Assessment Policy

• Question 299:

  During your assessment of CA.L2-3.12.3 ?Security Control Monitoring, the contractor's CISO informs you that they have established a continuous monitoring program to assess the effectiveness of their implemented security controls. When examining their security planning policy, you determine they have a list of automated tools they use to track and report weekly changes in the security controls. The contractor has also established a feedback mechanism that helps them identify areas of improvement in their security controls. Chatting with employees, you understand the contractor regularly invites resource persons to train them on the secure handling of information and identifying gaps in security controls implemented. Can the contractor place practice CA.L2-3.12.3 ?Security Control Monitoring under a POAandM if unimplemented or not fully met?

  A. No, the practice cannot be placed on a POAandM
  B. Yes, for some aspects
  C. More information is required to make determination
  D. Yes, for all aspects
  A. No, the practice cannot be placed on a POAandM

• Question 300:

  An OSC and a C3PAO Assessment Team are in the early stages of preparing for their CMMC assessment. During the process of confirming the corporate identity for the assessment, the Assessment Team discovers that the OSC does not have a valid Commercial and Government Entity (CAGE) code issued by the Department of Defense. The team is now considering the implications of this finding and the next steps they should take. When confirming the corporate identity to be assessed, what can happen if you determine that the HQ organization doesn't have a valid CAGE code?

  A. You would help the OSC register and obtain a CAGE code from the DoD.
  B. The assessment cannot continue.
  C. You would request a waiver from the DoD.
  D. You would continue with the assessment as planned.
  B. The assessment cannot continue.