Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 291:

  Removable media can pose significant cybersecurity risks to an organization if not adequately controlled and secured. Understanding the dangers of this, an OSC has crafted a meticulous removable media policy. It defines removable media, types of removable media, examples of removable media, etc. The policy limits the use of removable media unless authorized; even then, the media must be scanned for

  malware. Organizational removable media has specific signatures unique to organizational systems and provided to a defined group of personnel. Any data stored on such media is encrypted, and the OSC has disabled autorun and closed some ports on their computer systems. The contractor also has deployed an endpoint protection solution for every employee searched while entering or leaving the facility. Users must also pass through a walk-in metal detector to ensure they do not sneak in thumb drives and SD cards.

  Based on the OSC's effort, how would you score their implementation of CMMC practice MP.L2-3.8.7 - Removable Media?

  A. Not Applicable
  B. Met
  C. Partially Met
  D. Not Met
  B. Met

• Question 292:

  Angela, a CCA, is conducting a CMMC assessment for Obsidian Technologies, the OSC. During the assessment, Angela learns that her spouse owns a significant amount of stock in Obsidian Technologies, and she has not disclosed this information to Obsidian Technologies or the C3PAO.

  Which CMMC CoPC guiding principle has Angela violated in this scenario?

  A. Objectivity
  B. Impartiality
  C. Adherence to Materials and Methods
  D. Confidentiality
  A. Objectivity

• Question 293:

  A CCA is conducting a CMMC assessment and notices that the OSC's evidence includes screenshots of system configurations that are not dated. The OSC claims the screenshots are current.

  How should the CCA proceed?

  A. Accept the screenshots as evidence since the OSC claims they are current.
  B. Document the lack of dates as an evidence gap and request additional verification of currency.
  C. Reject the screenshots and score the related practice as "NOT MET."
  D. Ask the OSC to recreate the screenshots with current dates during the assessment.
  B. Document the lack of dates as an evidence gap and request additional verification of currency.

• Question 294:

  An OSC creates standard user accounts with limited capabilities and administrator accounts with full system access. A standard user initiates the uninstall of the anti-virus software, which is organizationally defined as a privileged function.

  Which of the following would indicate AC.L2-3.1.7: Privileged Functions is properly implemented?

  A. The antivirus software is not uninstalled.
  B. The antivirus software is successfully uninstalled.
  C. The antivirus software is not uninstalled, and the attempt is captured in an application audit log.
  D. The antivirus software is successfully uninstalled, and the event is captured in an application audit log.
  C. The antivirus software is not uninstalled, and the attempt is captured in an application audit log.

  ---

  Explanation

  Applicable Requirement: AC.L2-3.1.7 -"Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs."

  A non-privileged (standard) user should be prevented from performing privileged functions (e. g., uninstalling security software).

  The attempt must be logged to provide traceability and support accountability.

  Why Option C is Correct: It demonstrates both prevention (software not uninstalled) and auditing (attempt captured in a log), exactly matching the practice.

  Why Other Options Are Insufficient:

  Option A: Prevention is shown, but there is no evidence of logging.

  Option B: Function was not prevented, so requirement not met.

  Option D: Logging exists, but privileged action ws not prevented.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - AC.L2-3.1.7 NIST SP 800-171A - AC.L2-3.1.7 Assessment Objectives

  CMMC Assessment Guide - Level 2, AC.L2-3.1.7

• Question 295:

  Steve is a Certified CMMC Assessor (CCA) who works for ACME Inc., which is both an RPO and a C3PAO. His aunt Mary works for ABC Holdings, and based on this connection, Steve convinces her boss to hire ACME Inc. to help prepare for a CMMC assessment. Steve leads the team and successfully completes the engagement with ABC Holdings. Six months later, Mary informs Steve that ABC Holdings is ready to perform its CMMC Level 2 assessment. Steve jumps at the opportunity and convinces his management at ACME Inc. to assign him as the lead CCA along with two other employees.

  Which of the following is true about Steve's involvement in ABC Holdings' CMMC assessment?

  A. Steve has a conflict of interest and should not be involved in officially assessing ABC Holdings.
  B. Steve can participate in the CMMC assessment for ABC Holdings if they were bound by an NDA during the initial engagement.
  C. Since enough time has passed, Steve can remain objective and impartial in the assessment.
  D. Steve can participate in the assessment if he did not directly implement any security controls during the preparatory engagement.
  A. Steve has a conflict of interest and should not be involved in officially assessing ABC Holdings.

• Question 296:

  While conducting a Level 2 Assessment, the Assessment Team begins reviewing assessment objects.

  The team identifies concerns with several of the objects presented.

  Which artifacts would require the MOST verification?

  A. Current artifacts produced by individuals performing the work
  B. Artifacts created 18 months ago by individuals performing the work
  C. Current artifacts produced by individuals that work for a separate entity of the company
  D. Artifacts created 18 months ago by individuals that work for a separate entity of the company
  D. Artifacts created 18 months ago by individuals that work for a separate entity of the company

  ---

  Explanation

  Applicable Requirement (CAP - Evidence Validity): Evidence must be relevant, reliable, and timely.

  Artifacts from separate entities or outdated sources require extra scrutiny.

  Why Option D is Correct: The least reliable evidence is old (18 months) and produced by individuals not part of the OSC entity being assessed. Such artifacts require the most verification to determine applicability.

  Why Other Options Are Insufficient:

  Option A: Strongest evidence (current and from OSC staff).

  Option B: Outdated, but still from OSC staff (more reliable than outside entity).

  Option C: Current, but external (still stronger than outdated + external).

  References (CCA Official Sources):

  CMMC Assessment Process (CAP) v1.0 - Evidence Collection and Reliability Criteria CMMC Assessment Guide - Level 2 - Acceptable Evidence

• Question 297:

  The Lead Assessor concludes that the OSC is not ready for the assessment. After the Readiness Assessment Review, the OSC and the Lead Assessor could choose to:

  A. Replan or cancel the assessment.
  B. Replan or reschedule the assessment.
  C. Proceed as planned or cancel the assessment.
  D. Proceed as planned or reschedule the assessment.
  B. Replan or reschedule the assessment.

  ---

  Explanation

  The CMMC Assessment Process (CAP) provides explicit guidance for readiness reviews. If the Lead Assessor determines that the OSC is not prepared, the available options are:

  Replan the assessment (adjust scope, timeline, or requirements), or Reschedule the assessment (move the engagement to a later date).

  Extract:

  "Following the readiness review, if the OSC is determined not to be ready, the Lead Assessor may recommend that the assessment be replanned or rescheduled."

  Thus, the correct answer is.B

  References:

  CMMC Assessment Process (CAP), Readiness Review section.

• Question 298:

  During a CMMC assessment, the OSC's IT manager asks the CCA if they can "fix" a non-compliant practice during the assessment to improve their score. The CCA declines and continues the assessment.

  What CoPC principle does the CCA uphold by refusing to assist?

  A. Confidentiality
  B. Professionalism
  C. Objectivity
  D. Information Integrity
  C. Objectivity

• Question 299:

  A CCA is offered a significant discount on cybersecurity software from a vendor whose product they will be evaluating during a CMMC assessment.

  How should the CCA handle this situation according to the CoPC's conflict of interest principle?

  A. Inform the vendor that they can accept such offers only after the CMMC assessment is done.
  B. Accept the discount and disclose it to the C3PAO for transparency.
  C. Decline the discount to avoid any appearance of a conflict.
  D. Recommend the software to the OSC during the assessment, highlighting its value proposition.
  C. Decline the discount to avoid any appearance of a conflict.

• Question 300:

  You are the Lead Assessor for a CMMC assessment of an OSC that has previously obtained ISO 27001 certification for its information security management system. During the initial discussions, the OSC requests that you consider their ISO 27001 certification and grant them credit toward their CMMC certification. They believe there is a significant overlap between CMMC and ISO 27001.

  What should your response to the OSC be?

  A. Defer the decision on non-duplication credit until the DoD publishes official non-duplication policies.
  B. Verify the validity and authenticity of the OSC's ISO 27001 certification against the requirements outlined in the CMMC Assessment Process (CAP) before considering granting any non-duplication credit.
  C. Inform the OSC that alternative cybersecurity certifications like ISO 27001 do not automatically bestow any status or credit towards CMMC certification.
  D. Grant the OSC credit towards their CMMC certification based on their ISO 27001 certification,as both standards cover similar cybersecurity requirements.
  C. Inform the OSC that alternative cybersecurity certifications like ISO 27001 do not automatically bestow any status or credit towards CMMC certification.