Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 311:

  What is NOT required for the Lead Assessor to confirm when verifying readiness to conduct an assessment?

  A. That risks have been identified
  B. That necessary logistics have been arranged
  C. Whether the OSC can better meet the targeted CMMC Level
  D. That evidence is available and accessible for the targeted CMMC Level
  C. Whether the OSC can better meet the targeted CMMC Level

  ---

  Explanation

  The Lead Assessor's readiness checks focus on logistics, scope, evidence availability, and risk awareness to ensure the assessment can proceed. It is not the assessor's role to advise or determine if the OSC could achieve a higher certification level - the OSC selects its target level.

  Exact extracts:

  "Lead Assessors must confirm readiness by verifying logistics, scope boundaries, risks, and evidence availability." "Assessors do not advise OSCs on selecting certification levels or alternative approaches; this is outside the assessment scope."

  Why the other options are required:

  Option A: OSC risks must be identified and discussed as part of scoping.

  Option B: Logistics (scheduling, facilities, communications) must be confirmed.

  Option D: Evidence must be available and accessible to avoid delays.

  References:

  CMMC Assessment Process (CAP), Pre-Assessment Readiness Activities.

  CCA Study Guide - Lead Assessor Responsibilities.

• Question 312:

  As the Lead Assessor conducting a CMMC Level 2 assessment for an OSC, the Assessment Team has thoroughly reviewed all evidence provided by the OSC for the in-scope CMMC practices. Throughout the assessment process, daily checkpoint meetings were held with the OSC to allow them to present additional evidence and clarify any concerns. After the final evidence review and discussions, the Assessment Team has determined that 92 out of the 110 CMMC Level 2 practices have been scored as MET. Additionally, 18 practices have been scored as NOT MET, with 5 of those practices deemed ineligible for a Plan of Action and Milestones (POA&M) due to their potential impact on network exploitation or CUI exfiltration. The OSC has provided a draft POA&M for the remaining 13 NOT MET practices, outlining their proposed remediation actions and timelines. In reviewing the OSC's draft POA&M, you notice that one of the proposed remediation actions involves implementing a new security control that could potentially impact the effectiveness of another practice that was scored as MET.

  How should you proceed?

  A. Note the concern but allow the POA&M to proceed, as the impact on other practices can be reassessed during the next CMMC assessment.
  B. Accept the POA&M as it is, provided that the proposed remediation timelines are reasonable.
  C. Request the OSC to revise the POA&M, removing any actions that could limit the effectiveness of practices scored as `MET.'
  D. Reject the entire POA&M and require the OSC to resubmit it with all necessary corrections.
  C. Request the OSC to revise the POA&M, removing any actions that could limit the effectiveness of practices scored as `MET.'

• Question 313:

  During an assessment, the IT security engineers responsible for password policy for the OSC provided documentation that all passwords are protected using a one-way hashing methodology.

  As a result, which statement is true?

  A. Passwords are protected in storage and in transit.
  B. Passwords are transmitted across the network as clear cipher-text.
  C. The password protection allows access but not authorization to assets.
  D. The transformation makes it impossible to re-convert the hashed password.
  D. The transformation makes it impossible to re-convert the hashed password.

  ---

  Explanation

  A one-way hash function is a cryptographic method used to store passwords securely. It is not reversible;

  hashed values cannot be converted back into the original password.

  Extract from SC.L2-3.13.10: "Store and transmit authentication information in a protected form by using one-way cryptographic transformations (e.g., hashing). One-way transformations cannot be reversed to reveal the original authentication secret."

  Thus, the correct statement is that the transformation makes it impossible to re-convert the hashed password.

• Question 314:

  You are the Lead Assessor for an upcoming CMMC assessment with an OSC. You meet with the OSC's Assessment Official to identify and manage any potential conflicts of interest (COIs) that may arise. You explain the importance of avoiding or mitigating COIs to maintain objectivity and impartiality throughout the assessment process. Together, you review the CMMC Code of Professional Conduct and discuss any circumstances that could create a real or perceived COI for you or the assessment team members.

  What is the primary responsibility of the Lead Assessor regarding conflicts of interest?

  A. Developing mitigation plans independently for any identified COIs.
  B. Ensuring that all assessment team members sign the "Absence of Conflict-of-Interest Confirmation Statement."
  C. Identifying potential COIs and documenting them in the Pre-Assessment Plan.
  D. Submitting the signed "Absence of Conflict-of-Interest Confirmation Statement" to the CMMC Accreditation Body.
  C. Identifying potential COIs and documenting them in the Pre-Assessment Plan.

• Question 315:

  The CMMC Assessment Process (CAP) requires the Lead Assessor to validate the CMMC Assessment Scope proposed by the OSC.

  What is the main task that the Lead Assessor must conduct in validating the CMMC Assessment Scope?

  A. Document any discrepancies between the OSC's proposed scope and the actual systems and data.
  B. Verify that the boundaries within the organization's networked environment contain all the assets that will be assessed based on the assessment scope.
  C. Determine if any additional systems or data should be included in the assessment scope.
  D. Ensure that the OSC has reviewed and approved the assessment scope.
  B. Verify that the boundaries within the organization's networked environment contain all the assets that will be assessed based on the assessment scope.

• Question 316:

  You are working as a CCA on a Level 2 Assessment for a DoD prime contractor. The Organization Seeking Certification (OSC) seeks to keep assessment costs down, and the C3PAO and OSC have decided to conduct all possible work remotely. You are assigned to work primarily on the Media Protection (MP), Personnel Security (PS), and Physical Protection (PE) domains. In addition, the Lead Assessor has designated you as the one person from the Assessment Team to conduct all the on-premises work.

  Which of the following factors do you and the Assessment Team not need to consider as part of your on-site work?

  A. For the virtual aspects of the assessment, availability of a DoD-approved collaboration tool for virtual communication with the OSC
  B. Limitations of conducting on-premises assessments for the Media Protection (MP), Personnel Security (PS), and Physical Protection (PE) domains
  C. For the virtual aspects of the assessment, the mandatory Virtual Assessment Evidence Preparation Template must be used to ensure proper assessment methods
  D. Non-critical areas of the OSC facilities
  D. Non-critical areas of the OSC facilities

• Question 317:

  You are a Lead Assessor working with your C3PAO to conduct a CMMC Assessment for an OSC. During the preparation and planning phase, you meet with the OSC's Assessment Official to identify the resources and schedule for the upcoming assessment. Together, you review the OSC's pre-assessment information to estimate the level of effort required. You then collaborate to determine the specific resources needed, including the Assessment Team members, facilities, and any support personnel from the OSC. You also discuss scheduling factors like duration, key activities, and potential constraints. Based on these discussions, you develop a Rough Order of Magnitude (ROM) cost estimate and a proposed daily schedule for the assessment activities.

  Which of the following is not a requirement when identifying resources and schedules?

  A. Documenting the names and roles of all assessment participants.
  B. Recording the facilities to be used and their configurations.
  C. Negotiating the pricing structure of the contract with the OSC.
  D. Identifying potential triggers for replanning or updating the assessment plan.
  C. Negotiating the pricing structure of the contract with the OSC.

• Question 318:

  An assessor is examining an organization's system maintenance program. While reviewing the system maintenance policy and the OSC's maintenance records for the CUI network, the assessor notices there is no mention of printers. The assessor asks the IT manager if the company has any printers.

  Why is the assessor concerned if the OSC has printers?

  A. Printers must be completely isolated from all non-CUI assets.
  B. Firmware on a network printer needs to have updates as needed.
  C. Printers cannot be used on a CUI network without government approval.
  D. Printers can produce hard copies of CUI data that need to be safeguarded.
  D. Printers can produce hard copies of CUI data that need to be safeguarded.

  ---

  Explanation

  Printers are a concern because they can produce hard copies of CUI, which must be safeguarded like digital CUI. CUI handling requirements extend to both electronic and printed media.

  Extract from MP.L2-3.8.4:

  "Protect the confidentiality of CUI at rest and in use, including hardcopy outputs such as printed material."

  Thus, the concern is that printed CUI must be protected, making printers relevant to maintenance and safeguarding practices.

  References:

  CMMC Assessment Guide - Level 2, MP Domain.

• Question 319:

  Both the SSP and network diagrams presented to the Lead Assessor by the OSC indicate managed service providers (MSPs) within the assessment boundary.

  In order to BEST understand the impact of the MSPs, what should the Lead Assessor do?

  A. Ascertain what employees the MSP has onsite
  B. Request the customer responsibility matrix related to the MSPs
  C. Review the inventory to see how the assets have been classified
  D. Inspect the other initial documents presented including policies and organization charts
  B. Request the customer responsibility matrix related to the MSPs

  ---

  Explanation

  The Shared Responsibility Matrix (Customer Responsibility Matrix) is a key artifact in CMMC assessments involving MSPs or cloud service providers. It defines what security responsibilities belong to the OSC and which belong to the service provider. To evaluate the MSP's impact, the assessor must review this matrix to understand boundaries of responsibility for CUI protection.

  Exact extracts:

  "When external service providers are included in the assessment boundary, organizations must provide documentation that specifies security responsibilities." "A Shared Responsibility Matrix (or Customer Responsibility Matrix) defines which controls are implemented by the OSC versus the external provider." "Assessors should request and review this matrix to understand division of responsibilities."

  Why the other options are incorrect:

  Option A: Onsite MSP staff presence does not clarify responsibility for security controls.

  Option C: Reviewing classification helps, but it does not explain responsibility allocation.

  Option D: Policies/org charts do not establish shared control responsibilities.

  References:

  CMMC Assessment Guide - Level 2, External Service Providers OSC documentation requirements.

  CMMC Scoping Guide - Managed Service Provider treatment.

• Question 320:

  CMMC practice PS.L2-3.9.1 - Screen Individuals requires individuals to be screened before authorizing access to organizational systems containing CUI. However, in the assessment you are currently conducting, there is no physical evidence confirming the completion of personnel screens, such as background checks, only affirmations derived from an interview session. In an interview with the HR

  Manager, they informed you that before an individual is hired, they submit their information through a service that performs criminal and financial checks.

  How would you score the OSC's implementation of CMMC practice PS.L2-3.9.1 - Screen Individuals, objective [a]?

  A. More information is needed
  B. Not Met
  C. Not Applicable
  D. Met
  A. More information is needed