Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 331:

  When assessing an OSC's compliance with IR requirements, you realize they have deployed a system that tracks incidents, documents details, and updates the status throughout the incident response process.

  Personnel to whom incidents must be reported are identified and designated. While examining their documentation, you come across an incident response template that they use to capture all relevant information and ensure consistency in reporting to the identified authorities and organizational officials.

  Interviewing the IR team, you learn there is an escalation process that the contractor's cybersecurity team can use to address more serious incidents.

  From the scenario, the contractor has met all the required objectives for CMMC practice IR.L2-3.6.2 - Incident Reporting, meaning its implementation of the said practice will be scored MET with a total of 5 points.

  For how long must the OSC retain the incident records?

  A. 72 hours
  B. 90 days
  C. 90 hours
  D. 72 days
  B. 90 days

• Question 332:

  You are assessing an OSC that uses various collaborative computing devices, such as video conferencing systems, networked whiteboards, and webcams, for remote meetings and presentations. During your assessment, you examine the OSC's collaborative device inventory and find that they have identified and documented all collaborative computing devices. Most of the identified devices have indicators, such as LED lights, that notify users when the devices are in use. The OSC has also implemented a policy prohibiting the remote activation of collaborative computing devices without user consent. However, you find that the webcams can be activated remotely by authorized IT personnel for troubleshooting purposes.

  In addition to interviewing personnel, what other evidence would be helpful to assess the OSC's compliance with CMMC practice SC.L2-3.13.12 - Collaborative Device Control regarding the remote activation of webcams?

  A. A documented risk assessment that identifies the potential risks associated with remote camera activation and outlines mitigation strategies
  B. Network traffic logs showing no instances of remote activation attempts on the web cameras
  C. User training records indicating that employees are aware of the policy and understand thepotential consequences of unauthorized remote camera activation
  D. System configuration settings for the web cameras, verifying that remote activation is enabled
  A. A documented risk assessment that identifies the potential risks associated with remote camera activation and outlines mitigation strategies

• Question 333:

  You are assessing Conedge Ltd, a contractor that develops cryptographic algorithms for classified government networks. In reviewing their network architecture documents, you see they have implemented role-based access controls on their workstations using Active Directory group policies. Software developers are assigned to the "Dev_Roles" group which grants access to compile and test code modules.

  The "Admin_Roles" group with elevated privileges for system administration activities is restricted to the IT staff. However, when you examine the event logs on a developer workstation, you find evidence that a developer was able to enable debugging permissions to access protected kernel memory - a privileged function.

  How should execution of the debugging permission be handled to align with AC.L2-3.1.7 - Privileged Functions?

  A. Require it to generate an email alert
  B. Perform automatic termination of the action
  C. Implement geo-IP blocking on the workstation
  D. Ensure it is logged to the central SIEM system
  D. Ensure it is logged to the central SIEM system

• Question 334:

  During a CMMC assessment, as the Lead Assessor, you realize that the OSC relies on a Managed Service Provider (MSP) to oversee some of their IT infrastructure, including a cloud-based storage solution. Employees access the cloud storage remotely through a web browser. The OSC has a Service Level Agreement (SLA) with the MSP outlining security protocols. However, you have limited access to the internal configuration and security controls of the MSP's cloud environment.

  What challenges might you encounter when assessing the OSC's compliance with CMMC's external connection controls?

  A. The use of a web browser for remote access eliminates the need to evaluate external connection security
  B. Limited visibility of the MSP's cloud environment could hinder assessment of how the OSC manages secure external connections to their cloud storage (AC.L1-3.1.20). The SLA might not provide sufficient detail about the specific controls implemented
  C. CMMC focuses only on the security of the OSC's on-premises network, not that of external cloud services
  D. Verifying the effectiveness of the OSC's employee training programs may be difficult
  B. Limited visibility of the MSP's cloud environment could hinder assessment of how the OSC manages secure external connections to their cloud storage (AC.L1-3.1.20). The SLA might not provide sufficient detail about the specific controls implemented

• Question 335:

  During an assessment, the OSC IT security team provided documentation on how they use replay-resistant authentication to protect CUI.

  What can be used as a replay-resistant mechanism?

  A. Encrypted messages
  B. Biometric techniques
  C. Requiring Transport Layer Security (TLS)
  D. MFA devices to protect access for local users
  C. Requiring Transport Layer Security (TLS)

  ---

  Explanation

  Applicable Requirement: IA.L2-3.5.4 -"Use replay-resistant authentication mechanisms for network access to privileged accounts and for network access to non-privileged accounts."

  Why Option C is Correct: Transport Layer Security (TLS) is explicitly listed in NIST SP 800-171 Rev. 2 as an acceptable replay-resistant mechanism, as it prevents intercepted credentials from being reused.

  Why Other Options are Insufficient:

  Option A (Encrypted messages): Provides confidentiality but not inherently replay resistance.

  Option B (Biometrics): Supports authentication but does not prevent replay of transmitted credentials.

  Option D (MFA devices): Strong authentication, but not necessarily replay-resistant for transmitted session data.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - IA.L2-3.5.4 (Replay Resistance) NIST SP 800-171A - IA.L2-3.5.4 Assessment Objectives

• Question 336:

  A C3PAO has hired a full-time CCA and included them in an Assessment Team sent to conduct a CMMC assessment. However, as part of their agreement with Cyber AB, the CCA and, by extension, the C3PAO are expected to uphold a set of values during the assessment.

  What document sets the expectations for accredited and credentialed entities authorized to deliver CMMC services under Cyber AB licensing?

  A. Code of Professional Control
  B. CMMC Code of Professional Conduct
  C. CMMC Code of Ethical Conduct
  D. Code of Ethical Conduct
  B. CMMC Code of Professional Conduct

• Question 337:

  When assessing a contractor's implementation of CMMC practices, you examine its SystemSecurity Plan (SSP) to identify its documented measures for audit reduction and reporting. They have a dedicated section in their SSP addressing the Audit and Accountability requirements. You proceed to interview their information security personnel, who informed you that the contractor has a dedicated Security Operations Center (SOC) and uses Splunk to reduce and report audit logs.

  What key features regarding the deployment of Splunk for AU.L2-3.3.6 - Reduction&; Reporting would you be interested in assessing?

  A. Ensure that Splunk is configured with appropriate RBAC to restrict access to log data, reports, and dashboards, ensuring that only authorized personnel can view or modify audit logs
  B. Ensure Splunk can retain audit records for a protracted amount of time
  C. Ensure that Splunk employs various filter rules for reducing audit logs to eliminate non-essential data and processes to analyze large volumes of log files or audit information, identifying anomalies and summarizing the data in a format more meaningful to analysts, thus generating customized reports
  D. Ensure Splunk can support compliance dashboards that provide real-time visibility into CMMC compliance status
  C. Ensure that Splunk employs various filter rules for reducing audit logs to eliminate non-essential data and processes to analyze large volumes of log files or audit information, identifying anomalies and summarizing the data in a format more meaningful to analysts, thus generating customized reports

• Question 338:

  The Lead Assessor and OSC Assessment Official determined the resources, cost, and schedule for an upcoming assessment. The Lead Assessor noted the OSC Assessment Official's preferences regarding the limits of the method and the consequent resource, cost, and schedule constraints to arrive at an optimal Assessment Plan.

  In this situation, who has responsibility for signing the planning agreement?

  A. Lead Assessor
  B. OSC Assessment Official
  C. OSC Assessment Official and Lead Assessor
  D. OSC Assessment Official, Lead Assessor, and C3PAO
  C. OSC Assessment Official and Lead Assessor

  ---

  Explanation

  The Assessment Plan (planning agreement) must be signed by both the Lead Assessor and the OSC Assessment Official. This formalizes agreement on scope, resources, and methodology. The C3PAO is responsible for overall oversight but does not co-sign the plan.

  Exact extracts:

  "The Lead Assessor is responsible for developing the Assessment Plan in collaboration with the OSC Assessment Official." "Both the Lead Assessor and the OSC Assessment Official must sign the Assessment Plan to proceed." "The C3PAO maintains responsibility for quality assurance and submission, but not signing."

  Why other options are incorrect:

  Option A/B: Both signatures are required, not one alone.

  Option D: The C3PAO does not sign the planning agreement.

  References:

  CMMC Assessment Process (CAP), Assessment Planning.

• Question 339:

  As the Lead Assessor for your Assessment Team, you are validating an OSC's scope in readiness to start the assessment. You learn that the OSC provides its employees with laptops to work on DoD projects.

  These laptops have an antivirus solution that connects to a management console to receive updates, send alerts, and control settings. However, the server does not process, store, or transmit CUI but implements several CMMC controls.

  Which of the following is NOT part of the OSC's requirements regarding the antivirus solution?

  A. Itemize the solution in the CMMC Assessment Scope's network diagram and prepare it to be assessed against CMMC practices.
  B. They should document the specifics of the antivirus solution in the asset inventory.
  C. The OSC should document it in the System Security Plan (SSP).
  D. Logically separate the antivirus solution from other CUI assets.
  D. Logically separate the antivirus solution from other CUI assets.

• Question 340:

  You are a CCA reviewing evidence for a CMMC practice. The OSC provides a training record showing that only 70% of relevant staff have completed required security training. The practice requires all staff to be trained.

  How should you score this practice?

  A. Score it as "MET" since the majority of staff are trained.
  B. Score it as "NOT MET" since not all staff have completed the required training.
  C. Score it as "PARTIALLY MET" and allow the OSC to train the remaining staff during the assessment.
  D. Document it as an evidence gap and request additional training records.
  B. Score it as "NOT MET" since not all staff have completed the required training.