Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 311:

  You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 ?Report Recommended Assessment Results. You are preparing to deliver the final recommended findings to the OSC Assessment Official and OSC participants during the Final Findings Briefing. After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?

  A. The C3PAO CQAP conducts an internal quality review of the Assessment Results Package.
  B. The OSC submits an appeal using the Assessment Appeals Process if it disagrees with the findings.
  C. You submit the Assessment Results Package directly to CMMC eMASS.
  D. You archive all assessment artifacts and dispose of them after three years.
  A. The C3PAO CQAP conducts an internal quality review of the Assessment Results Package.

• Question 312:

  When examining a contractor's access control policy and SSP, you observe that system administrators routinely use accounts with elevated privileges for checking email and browsing internal websites. What CMMC practice does this violate?

  A. AC.L2-3.1.7
  B. AC.L2-3.1.6
  C. AC.L2-3.1.4
  D. AC.L2-3.1.2
  B. AC.L2-3.1.6

• Question 313:

  A leading technology solutions provider that works with various government agencies and commercial clients has implemented a dedicated CUI enclave within its network infrastructure to ensure the secure handling of CUI. As a Certified CMMC Assessor, you are tasked with assessing the scope of the solutions provider's CMMC requirements. Which statement best describes the appropriate approach for scoping the assessment within the context of the CUI enclave?

  A. The assessment scope is limited to the physical boundaries of the solutions provider's CUI security domain, excluding any logical or network-based interactions.
  B. Regardless of the CUI security domain implementation, the entire solutions provider's network and all system components must be assessed.
  C. The assessment scope should include the solutions provider's CUI enclave and any supporting organization's components or systems that interact with or provide services to the CUI security domain.
  D. Only the solutions provider's CUI security domain needs to be assessed, as it is the designated system component for handling CUI data.
  C. The assessment scope should include the solutions provider's CUI enclave and any supporting organization's components or systems that interact with or provide services to the CUI security domain.

• Question 314:

  As a CCA, you are conducting an assessment of an OSC's implementation of AC.L2-3.1.7 ?Privileged Functions. This requirement mandates that the organization prevent non- privileged users from executing privileged functions and capture the execution of such tasks in audit logs. During your assessment, you want to determine whether the OSC has properly defined privileged functions, as assessment objective [a] requires. Which Assessment Objects would you most likely examine to make this determination?

  A. Interviews with System Developers
  B. User acknowledgements of notification message or banner
  C. The organization's Privacy and Security policies and System Design documentation
  D. System use notification messages
  C. The organization's Privacy and Security policies and System Design documentation

• Question 315:

  A defense contractor has a complex network design with multiple VLANs. The network is divided into three VLANs: VLAN 10 for the administrative offices, VLAN 20 for the engineering department, and VLAN 30 for the manufacturing floor. The company's System Security Plan states that VLANs are used to create logical network segments and improve security. A Layer 3 switch is responsible for routing traffic between the VLANs, and the switch is configured to allow any type of traffic between the VLANs. How should VLANs be treated when defining the contractor's CMMC Assessment Scope?

  A. Do not include any VLAN in the CMMC assessment scope.
  B. Include them in the CMMC Assessment Scope.
  C. Include only VLAN 30 in the CMMC assessment scope as it directly interacts with CUI.
  D. Include only VLAN 20 and VLAN 30 in the assessment scope.
  B. Include them in the CMMC Assessment Scope.

• Question 316:

  John, a Certified CMMC Assessor, has been conducting CMMC assessments for several years. During a recent assessment at a defense contractor, he encountered several issues similar to challenges he had faced in previous assessments. Influenced by his past experiences, John's interpretation of the contractor's practices was shaped by his preconceptions. Which of the following is TRUE about John's interpretation?

  A. John's bias has no impact on the integrity of the assessment
  B. John's bias can affect the integrity of the CMMC assessment
  C. John's experience ensures that all assessments will be unbiased and accurate
  D. John's preconceptions help streamline the assessment process and ensure consistency
  B. John's bias can affect the integrity of the CMMC assessment

• Question 317:

  The OSC uses an on-premises ERP system that processes and stores CUI data. A Third- Party Maintenance (TPM) provider has remote access to the ERP system for troubleshooting and maintenance purposes. The OSC allows the TPM to access the system through a secure remote access tool with Multi-Factor Authentication (MFA). As a Lead Assessor, what challenges might you encounter when assessing the OSC's compliance with CMMC's practice AC.L2-3.1.12 ?Control Remote Access?

  A. The use of a dedicated remote access tool simplifies the assessment of access controls
  B. You might still face challenges in obtaining evidence of how the TPM's remote access sessions are monitored and controlled to ensure remote access sessions are controlled and authorized
  C. CMMC requirements apply only to cloud-based systems, not on-premises deployments
  D. You may have difficulty verifying the effectiveness of the on-premises security measures
  B. You might still face challenges in obtaining evidence of how the TPM's remote access sessions are monitored and controlled to ensure remote access sessions are controlled and authorized

• Question 318:

  The Assessment Kickoff meeting is one of the most important sessions of any CMMC Assessment engagement. All the following are participants in this meeting, EXCEPT?

  A. Members of the OSC that will be providing evidence.
  B. The Lead Assessor.
  C. The OSC PoC.
  D. The CMMC Quality Assurance Professional (CQAP).
  D. The CMMC Quality Assurance Professional (CQAP).

• Question 319:

  An OSC specializing in developing directed energy systems plans to bid on a DoD contract to produce a 250kW High Energy Laser Weapon System (HELWS). This system is to be deployed on military bases across the globe to protect U.S. servicemen against aerial threats, including mortars, rockets, and unmanned aerial vehicles (UAVs), as well as swarms of mini-UAVs. Because of the sensitivity of the information, the OSC has prohibited using emails to transmit information regarding the project, whether encrypted or otherwise. They also have instituted procedures to remove CUI from the email system. What CMMC assessment requirements must the Assessment Team follow regarding the OSC's email system?

  A. Since there are measures in place to prevent CUI transfer through email, the email system is out of scope and there is no need to assess it against CMMC practices.
  B. The Assessment Team must assess the email system against all CMMC practices.
  C. Review the SSP in accordance with practice CA.L2-3.12.4 - System Security Plan.
  D. Review the SSP in accordance with CA.L2-3.12.4 - System Security Plan and assess against other CMMC practices.
  C. Review the SSP in accordance with practice CA.L2-3.12.4 - System Security Plan.

• Question 320:

  During an assessment, you learn that a cybersecurity firm helped the OSC prepare for the assessment. In an attempt to learn more about this firm, the OSC POC gives you their name. Performing a quick search, you learn they aren't listed in

  the Cyber AB marketplace.

  What should you do as the Lead Assessor?

  A. Ignore it and continue with the assessment.
  B. Confront the RPO about this unethical behavior.
  C. Discontinue the assessment.
  D. Inform the OSC that the RPO isn't registered and report this to Cyber AB through your C3PAO.
  A. Ignore it and continue with the assessment.