Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 301:

  You are assessing an OSC that utilizes containerization technology for deploying microservices within a Kubernetes cluster. These microservices leverage various JavaScript frameworks for functionality. While a mobile device management (MDM) solution secures company phones, access to these microservices is primarily through web interfaces.

  From a mobile code control perspective, what is the primary concern in this scenario?

  A. The lack of mobile device management (MDM) for access through web interfaces
  B. Containerization technology itself might introduce security vulnerabilities
  C. The use of JavaScript in containerized microservices
  D. The potential execution of unauthorized mobile code through web interfaces
  D. The potential execution of unauthorized mobile code through web interfaces

• Question 302:

  An OSC employs guards to protect the manufacturing shop where the magnetic radar-absorbing coating is manufactured. The Army uses this specific coating for a particular fleet of unmanned aerial vehicles (UAVs). The facility is under constant surveillance with the help of HD CCTVs. Within the OSC's facilities is a Vector Network Analyzer (VNA) that measures the reflection and transmission properties of the coating over a range of frequencies. Guards protect the OSC's anechoic chamber, and anyone entering must use an iris scanner and sign a physical form detailing their name and reason for being there. At the door is a huge sign reading "Authorized Personnel Only."

  The OSC has implemented the following physical separation methods to secure its facilities, EXCEPT?

  A. Signage
  B. Monitoring
  C. Biometric locks
  D. Guards
  B. Monitoring

• Question 303:

  An OSC uses a cloud-based database for storing customer information. Employees access this database through a secure application on their company laptops. The database itself resides on servers managed by the Cloud Service Provider (CSP).

  When employees use the application to access customer data, what type of location are they reaching?

  A. A secure area within the OSC's data center
  B. A logical location on the CSP's servers
  C. A specific room within the CSP's facility
  D. The physical location of the company laptops
  B. A logical location on the CSP's servers

• Question 304:

  An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1 - System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet.

  The following conditions hold true for CMMC practices ineligible for deficiency corrections EXCEPT?

  A. Practices that could lead to significant exploitation of the network or exfiltration of CUI.
  B. Practices that were not implemented by the OSC prior to the current CMMC Assessment.
  C. Practices listed on the OSC's Self-Assessment Practice Deficiency Tracker.
  D. Practices that involve minor updates to existing policies or procedures but have been in place for a period of time.
  D. Practices that involve minor updates to existing policies or procedures but have been in place for a period of time.

• Question 305:

  A midsized professional services organization that frequently contracts with government entities is undergoing a CMMC Level 2 assessment. The CCA interviews IT leadership about their audit logging capabilities and determines that a third-party vendor is responsible for correlating and reviewing audit logs. During the interview, they discuss the process that has been implemented by the vendor to provide a monthly summary of their audit log review to the organization.

  What issue should the CCA resolve during the interview?

  A. The vendor has the ability to provide report generation.
  B. The vendor may not use the same authoritative time source.
  C. Audit logs must be reviewed on at least a weekly basis for CMMC requirements.
  D. Audit logs should not be correlated and reviewed by a third party as they may contain CUI.
  C. Audit logs must be reviewed on at least a weekly basis for CMMC requirements.

  ---

  Explanation

  CMMC Level 2 requires that audit logs be reviewed and updated at least weekly to detect anomalies and potential security incidents. A vendor providing only monthly summaries does not meet the requirement.

  The assessor must resolve this issue to confirm compliance.

  Exact Extracts (official CMMC Assessor/Study documents):

  AU.L2-3.3.7: "Review and update logged events, as well as the audit log, at least weekly." AU.L2-3.3.6: "Review and analyze information system audit records for indications of inappropriate or unusual activity and report findings." CMMC Level 2 Assessment Guide emphasizes: "Organizations must demonstrate procedures to review audit logs at least weekly, even when external vendors perform this function." NIST SP 800-171A states: "The frequency of review must be sufficient to detect anomalies in a timely manner... at least weekly is required."

  Why other options are not correct:

  Option A: Report generation capability is not the compliance issue; frequency of review is.

  Option B: Using a common authoritative time source (AU.L2-3.3.7) is important, but the deficiency here is frequency of log review, not time source. Option D: Third-party involvement is permitted if the OSC maintains control and ensures requirements (frequency, integrity, protection of CUI) are met.

  References (official CCA/CMMC documents):

  CMMC Assessment Guide - Level 2, Version 2.13: Practices AU.L2-3.3.6 and AU.L2-3.3.7 (pp. 56-60).

  NIST SP 800-171A, Audit and Accountability objectives.

• Question 306:

  An OSC has contacted your C3PAO organization for a prospective CMMC Level 2 assessment. You have been selected to lead the Assessment Team. When ascertaining the assessment conditions and requirements, you discuss the prospective CMMC assessment scope with the OSC.

  Before proceeding to Phase 2 of the CMMC assessment process, the OSC must complete the following steps of its high-level scoping process, EXCEPT?

  A. Identify and take inventory of the various categories of CMMC assets contained in the networked environment.
  B. Propose the scope of the CMMC assessment that will be evaluated by the Lead Assessor and validated by the C3PAO.
  C. Establish the CMMC Assessment Scope of their networked environment.
  D. Evaluate Model Non-Duplication.
  D. Evaluate Model Non-Duplication.

• Question 307:

  During the initial engagement with an OSC, they appoint an OSC Point of Contact (PoC). The Assessment Official informs your Assessment Team that they will regularly collaborate with the PoC in their daily engagements and assigns several responsibilities to this Point of Contact.

  Which of the following is not one of the OSC PoC's responsibilities?

  A. Coordinating site access and communicating visitation policies.
  B. Reviewing assessment results with the Lead Assessor.
  C. Managing logistics, such as ensuring adequate space for the team to meet with OSC representatives.
  D. Handling facility access and escorting daily visitors.
  B. Reviewing assessment results with the Lead Assessor.

• Question 308:

  A small manufacturing company plans to undergo a CMMC assessment and needs to validate its scope.

  The company uses a cloud-based customer relationship management (CRM) system hosted by an external provider to store and process customer information, including FCI and CUI.

  Which of the following components should the company include in the scope of their CMMC assessment?

  A. The company's internal servers and client computers, but not the cloud-based CRM system or the external service provider.
  B. Only the cloud-based CRM system.
  C. The cloud-based CRM system and the external service provider's (ESP's) systems should be included in the assessment scope.
  D. Only the external service provider's systems.
  C. The cloud-based CRM system and the external service provider's (ESP's) systems should be included in the assessment scope.

• Question 309:

  A DoD contractor developing guidance and targeting systems has subcontracted a data analytics company to analyze their data accuracy.

  How should the DoD contractor handle the analytics company when preparing a CMMC assessment scope?

  A. Include only assets of the analytics company that deal with their equipment data analytics.
  B. Include the entire analytics company in the assessment scope.
  C. Terminate their engagement with the analytics company during the assessment process.
  D. Do not include the analytics company in the CMMC assessment scope.
  A. Include only assets of the analytics company that deal with their equipment data analytics.

• Question 310:

  While assessing an OSC, you realize they have given identifiers to systems, users, and processes.

  Examining their documentation, you know they have assigned accounts uniquely to employees, contractors, and subcontractors. The OSC has an automated system that disables any identifiers that are left unused for 6 months. You also learn from interviewing IT security administrators that the OSC has defined a technical and documented policy where identifiers can only be reused after 12 months.

  How is the OSC likely to consider CMMC practice IA.L2-3.5.5 - Identifier Reuse if you find issues with its implementation?

  A. List it in their SSP
  B. Track it under limited deficiency correction
  C. Hire another C3PAO to verify your assessment
  D. Disregard it as it is not applicable
  B. Track it under limited deficiency correction