Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 321:

  During the examination of evidence for access control procedures, you review an OSC's Access Control List (ACL). The ACL appears to include most user accounts, but you notice that it lacks entries for several newly hired employees. You also realize that some parts of the OSC's access control policy haven't been signed and endorsed by senior management. Additionally, you notice multiple attestations from employees who are not the proper system owners.

  How should you proceed when encountering an incomplete artifact, such as the missing personnel in the access control list?

  A. Request the OSC to provide a revised, complete version of the artifact within a specified timeframe.
  B. Disregard the incomplete artifact and rely on other evidence for the practice assessment.
  C. Document the incomplete artifact as an evidence gap and proceed with assessing the practice based on the available evidence.
  D. Mark the associated CMMC practice as 'NOT MET' due to the incomplete artifact.
  C. Document the incomplete artifact as an evidence gap and proceed with assessing the practice based on the available evidence.

• Question 322:

  A CCA witnesses another CCA from their C3PAO team flirting with an OSC employee during a social event after completing the assessment.

  According to the CoPC, what is the most appropriate course of action for the observing CCA?

  A. Report the incident directly to the Cyber AB.
  B. Discreetly remind the other CCA of the CoPC's harassment and discrimination guidelines.
  C. Ignore the situation, as it doesn't impact the assessment.
  D. Publicly confront the other CCA about their unprofessional behavior.
  B. Discreetly remind the other CCA of the CoPC's harassment and discrimination guidelines.

• Question 323:

  A manufacturing company is seeking Level 2 certification. The loading docks are currently accessible directly from the company's main parking lot, which may lead to unauthorized access to facilities.

  Based on this information, how should this method be modified to BEST meet Level 2 requirements?

  A. Implement physical perimeter controls, such as turnstiles, to limit access.
  B. Require visitors to check in at the reception desk and maintain a visitor log.
  C. Implement physical perimeter controls, such as cameras, to limit access to only authorized personnel.
  D. Implement physical perimeter controls, such as a gate with a badge system, to limit access to only authorized personnel.
  D. Implement physical perimeter controls, such as a gate with a badge system, to limit access to only authorized personnel.

  ---

  Explanation

  Applicable Requirement: PE.L2-3.10.3 -"Control physical access to organizational systems, equipment, and the respective operating environments."

  Why Option D is Correct: A gate with a badge system represents preventive perimeter control that ensures only authorized personnel can access sensitive areas (e.g., loading docks). This directly aligns with Level 2 physical protection requirements.

  Why Other Options Are Insufficient:

  Option A (Turnstiles): More relevant for internal building entry, not loading docks.

  Option B (Visitor log): Supports accountability, but does not prevent unauthorized entry.

  Option C (Cameras): Provides monitoring but not control - surveillance alone does not restrict access.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - PE.L2-3.10.3 NIST SP 800-171A - PE.L2-3.10.3 Assessment Objectives CMMC Assessment Guide - Level 2, Physical Protection

• Question 324:

  You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 - Report Recommended Assessment Results. You are preparing to deliver the final recommended findings to the OSC Assessment Official and OSC participants during the Final Findings Briefing.

  After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?

  A. The C3PAO CQAP conducts an internal quality review of the Assessment Results Package.
  B. The OSC submits an appeal using the Assessment Appeals Process if it disagrees with the findings.
  C. You submit the Assessment Results Package directly to CMMC eMASS.
  D. You archive all assessment artifacts and dispose of them after three years.
  A. The C3PAO CQAP conducts an internal quality review of the Assessment Results Package.

• Question 325:

  An OSC has a minimal physical footprint consisting only of network equipment, workstations, and a centralized domain environment. File storage is centralized in a third-party vendor's FedRAMP Moderate authorized cloud environment, and employees access files using the cloud integration with their workstations.

  Since CUI is stored in the FedRAMP Moderate authorized environment, the OSC should prepare to have which environment(s) assessed?

  A. Cloud environment only
  B. OSC's physical network only
  C. Cloud environment and the OSC's physical network
  D. OSC's physical network, the cloud environment, and the cloud vendor's employee network
  C. Cloud environment and the OSC's physical network

  ---

  Explanation

  Both the CSP's cloud environment and the OSC's on-premises network/workstations are in-scope because CUI is stored in the cloud but also accessed and transmitted by OSC assets. The cloud vendor's internal employee network is not in-scope because only the customer-facing FedRAMP environment is within the assessment boundary.

  Exact extracts:

  "CUI Assets include any OSC asset that stores, processes, or transmits CUI."

  "External service providers are in-scope if their services process, store, or transmit CUI on behalf of the OSC.""The OSC's endpoints and local infrastructure that access CUI are also in-scope."

  Why the other options are incorrect:

  Option A: Cloud environment only is incomplete; OSC workstations also access and transmit CUI.

  Option B: OSC network only ignores the fact that CUI is stored in the cloud.

  Option D: The cloud vendor's internal employee network is not in-scope.

  References:

  CMMC Scoping Guide - Level 2 (CUI Assets External Service Providers).

• Question 326:

  As a Certified CMMC Assessor (CCA), you evaluate an OSC's implementation of the AC.L2-3.1.11 - Session Termination requirement during a CMMC Level 2 assessment. This requirement mandates the organization to automatically terminate a user session after defined conditions are met. During your

  assessment, you want to determine whether the OSC has properly defined theconditions that would trigger the automatic termination of a user session, as required by assessment objective [a].

  Which of the following assessment objects would you most likely examine to make this determination?

  A. The organization's system audit logs and records
  B. Procedures addressing identification and authentication
  C. Interviews with system administrators and personnel with information security responsibilities
  D. The organization's Access Control Policy and system configuration settings
  D. The organization's Access Control Policy and system configuration settings

• Question 327:

  To transfer CUI between a government client and its internal systems, a defense contractor uses a Secure File-Sharing Application provided by the DoD. However, all data traversing this boundary must pass through a next-generation firewall (NGFW) managed by the contractor's Network Admin. All CUI is stored on a Solid State Drive (SSD) and accessed through a laptop.

  What type of asset is the Network Admin?

  A. Contractor Risk Managed Asset (CRMA)
  B. Security Protection Asset (SPA)
  C. Specialized Asset
  D. CUI Asset
  B. Security Protection Asset (SPA)

• Question 328:

  During a POA&M Close-Out Assessment, the Lead Assessor encounters a situation where the organization's corrective actions for a specific practice have inadvertently limited the effectiveness of another practice that was previously scored as MET during the initial assessment.

  In this scenario, what should the Lead Assessor's recommendation to their C3PAO be?

  A. Update the POA&M and recommend the organization for CMMC Level 2 Final Certification, adding the affected practice to the POA&M.
  B. Defer the recommendation and request the organization to undergo a full reassessment.
  C. Recommend the organization for CMMC Level 2 Final Certification.
  D. Recommend the organization not be granted CMMC Level 2 Final Certification.
  D. Recommend the organization not be granted CMMC Level 2 Final Certification.

• Question 329:

  You are on-site with an Assessment Team at a medium-sized organization. When discussing how they protect their company's information from malware, spyware, etc., the administrator you are interviewing offers to show you the entire process from start to finish since she had that on her to-do list for the day.

  She opens the machine, turns it on, and installs what she says is anti-malware software. She also demonstrates how their deployed Next Generation Firewall (NGFW) works. You have never heard of this software, so you ask her where it was purchased. You later learn it is an open-source solution.

  Based on the scenario and the requirements of CMMC practice SI.L2-3.14.6 - Monitor Communications for Attacks, what is your likely determination?

  A. Find the OSC's implementation as partially Met as they are achieving several objectives required of this practice
  B. Fail the OSC's implementation of the practice
  C. Find the OSC's implementation of the practice as Met
  D. Request for more information
  D. Request for more information

• Question 330:

  During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can provide a list of recommended vendors to improve their security practices after the assessment.

  What should the Lead Assessor do?

  A. Provide the list after the assessment is complete to assist the OSC.
  B. Politely refuse, explaining that the C3PAO cannot offer consulting or vendor recommendations per the CoPC.
  C. Offer to provide general guidance on vendor selection without specific recommendations.
  D. Agree to provide the list but only after approval from the Cyber AB.
  B. Politely refuse, explaining that the C3PAO cannot offer consulting or vendor recommendations per the CoPC.