Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 351:

  During an assessment, the team is interviewing the IT staff to understand the ways in which the organization protects backup data. Because the company's backups contain CUI, the Lead Assessor asks the IT engineer which method is used to ensure that the confidentiality of the backup data is being protected.

  Which implementation is LEAST LIKELY to be acceptable?

  A. Alternative physical controls for site access
  B. Managing who has access to the information
  C. Physically securing devices and media that contain CUI
  D. Encrypting files or media using industry-standard encryption
  A. Alternative physical controls for site access

  ---

  Explanation

  When protecting backup data containing CUI, the requirement is to ensure confidentiality through logical or physical security controls appropriate to the sensitivity of CUI. Acceptable implementations include controlling access to CUI (AC family controls), physically securing media (MP family controls), and encrypting files or media (SC family controls). Merely implementing alternative physical controls for site access is insufficient because site access protections do not directly ensure the confidentiality of the backup media itself.

  Exact Extracts (from official CMMC Assessor/Study documents and NIST SP 800-171A references):

  SC.L2-3.13.16 (Encrypt CUI): "Employ cryptographic mechanisms to prevent unauthorized disclosure of CUI during storage and transmission unless otherwise protected by alternative physical safeguards." MP.L2-3.8.9 (Protect backup CUI):

  "Protect the confidentiality of backup CUI at storage locations." AC.L2-3.1.3 (Access enforcement): "Limit access to CUI on the basis of need-to-know to protect confidentiality." Physical security references (PE family): "Physical access controls provide general site protection but are not substitutes for encryption or media protection controls when CUI confidentiality is at risk."

  Why the other options are correct (acceptable methods):

  Option B (Managing who has access to the information): Satisfies Access Control (AC) requirements that limit exposure of CUI only to authorized individuals.

  Option C (Physically securing devices and media): Satisfies Media Protection (MP) requirements, ensuring CUI is stored securely and protected against unauthorized access.

  Option D (Encrypting files or media): Directly satisfies System and Communications Protection (SC) requirements for confidentiality, a highly reliable method.

  Why option A is least acceptable: Alternative physical controls for site access protect buildings or rooms, but they do not directly safeguard backup media confidentiality. If backups are removed, lost, or accessed internally, site access controls alone cannot ensure confidentiality.

  References (official CCA/CMMC documents):

  CMMC Assessment Guide - Level 2, Version 2.13: Practices SC.L2-3.13.16, MP.L2-3.8.9, AC.L2-3.1.3, and PE family discussion (pp. 93-96, 108-110, 125-127). NIST SP 800-171A, Assessing Security Requirements for CUI: Related assessment objectives for protecting CUI backup confidentiality.

• Question 352:

  As a Certified CMMC Assessor, you are part of a team assessing a small defense contractor. During the assessment, an employee being interviewed appears unsure about some security practices and asks for your advice on how to answer certain questions to make their compliance appear better.

  As a Certified CMMC Assessor, what should you do in this situation?

  A. Suggest that they seek guidance from another Assessor.
  B. Offer to create documentation to cover gaps in their compliance.
  C. Politely refuse to provide any assistance and continue the assessment as planned.
  D. Provide guidance on how to answer questions to maximize the appearance of compliance.
  C. Politely refuse to provide any assistance and continue the assessment as planned.

• Question 353:

  An Assessment Team is reviewing the network diagram provided by an OSC. The diagram will help the team understand how the OSC has set up assets across its network and determine whether it has implemented network separation and enclaves to protect its CUI. During the review, the team notices that the network diagram does not clearly delineate the boundaries between the enterprise and CUI environments, raising concerns about the assessment scope.

  What should the AssessmentTeam do in this situation?

  A. Proceed with the assessment based on the information provided in the network diagram
  B. Inform the Lead Assessor, who will request additional information and clarification from the OSC to better understand the separation and enclave implementation
  C. Recommend that the OSC engage a network security specialist to revise the network diagram
  D. Proceed with the assessment based on the information provided in the SSP and adjust the scope during the assessment
  B. Inform the Lead Assessor, who will request additional information and clarification from the OSC to better understand the separation and enclave implementation

• Question 354:

  You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery.

  What would you recommend the contractor do to avert the risk?

  A. Institute mandatory overtime for the engineer to complete tasks faster
  B. Fully implement AC.L2-3.1.4, Separation of Duties by assigning different engineers responsibility for design, coding, testing, and deployment. Implement peer code reviews and separate test and deployment duties
  C. Invest in more powerful development machines
  D. Increase the engineer's salary to incentivize careful work
  B. Fully implement AC.L2-3.1.4, Separation of Duties by assigning different engineers responsibility for design, coding, testing, and deployment. Implement peer code reviews and separate test and deployment duties

• Question 355:

  A CMMC assessment for an OSC finds it has fully implemented 87 out of 110 practices. Unfortunately, the Assessment Team determines that the POA&M Closeout Assessment option cannot be used.

  Consequently, the OSC will not be recommended for certification. However, the OSC assessment official humbly requests the Lead Assessor to adjust the findings to allow for POA&M closeout and mark a five-point practice as implemented.

  How should the Lead Assessor respond?

  A. Politely decline the request and cite ethical reasons of violating the CoPC.
  B. Negotiate with the OSC to implement additional practices and reassess the POA&M Closeout Assessment option.
  C. Report the request to the Cyber AB and recommend disciplinary action against the OSC assessment official.
  D. Agree to the request and tweak the findings.
  A. Politely decline the request and cite ethical reasons of violating the CoPC.

• Question 356:

  During your assessment of Defcon's (a contractor) implementation of CMMC Level 2 practices, you notice that their system for displaying security and privacy notices is insufficient. The banners currently in use lack detailed information about Controlled Unclassified Information (CUI)handling requirements and associated legal implications. Additionally, the banners are not consistently displayed across all contractor systems and workstations. Moreover, the banners on login pages disappear automatically after less than 5 seconds, providing insufficient time for users to read and acknowledge the content.

  Once the inconsistencies are addressed, when should the contractor's privacy and security notice be displayed?

  A. Only during the initial system logon
  B. During the initial system logon and when accessing specific CUI-related applications and data
  C. Only when handling or processing export-controlled technical data
  D. Continuously on all systems and workstations, regardless of user activity
  B. During the initial system logon and when accessing specific CUI-related applications and data

• Question 357:

  Regarding virtual data collection, which of the following actions is the highest priority?

  A. Training OSC personnel on proper document sharing practices.
  B. Recording the use of any virtual data collection techniques, including any risks and mitigations, and how any CUI, FCI, and/or OSC proprietary information will be managed and protected.
  C. Scheduling virtual meetings at times convenient for geographically dispersed employees.
  D. Implementing encryption for all communication channels used during interviews.
  B. Recording the use of any virtual data collection techniques, including any risks and mitigations, and how any CUI, FCI, and/or OSC proprietary information will be managed and protected.

• Question 358:

  During a CMMC Level 2 assessment, an OSC receives a Conditional Certification with several practices placed on a Plan of Action and Milestones (POA&M). After implementing corrective actions, the OSC requests the Assessment Team to conduct a POA&M Close-Out Assessment.

  Which of the following is the correct action for the Team's Lead Assessor during the POA&M Close-Out Assessment?

  A. Recommend the organization for CMMC Level 2 Final Certification if all POA&M items arefully implemented and do not limit the effectiveness of other practices scored as 'MET' during the initial assessment.
  B. Recommend the organization for CMMC Level 2 Final Certification if all POA&M items have been fully implemented and meet the required criteria.
  C. Recommend the organization for CMMC Level 2 Final Certification regardless of the POA&M items' impact on other practices.
  D. Recommend the organization reapply for CMMC Level 2 Certification, even if all POA&M items are fully implemented.
  A. Recommend the organization for CMMC Level 2 Final Certification if all POA&M items arefully implemented and do not limit the effectiveness of other practices scored as 'MET' during the initial assessment.

• Question 359:

  You are conducting a CMMC assessment for a contractor that handles sensitive defense project data.

  Reviewing their documentation shows that the contractor has an on-premises data center that houses CUI on internal servers and file shares. A corporate firewall protects this data center network. However, the contractor also uses a hybrid cloud infrastructure, storing some CUI in Microsoft Azure cloud storage, which can be accessed using ExpressRoute private network connections. Additionally, their engineers connect remotely to the data center to access CUI via a site-to-site VPN from their home networks.

  Which of the following components of the contractor's environment should NOT be in scope when assessing practice AC.L2-3.1.3 - Control CUI Flow?

  A. Azure cloud storage
  B. The corporate firewall and ExpressRoute connections
  C. The VPN and on-premises servers/file shares
  D. Employees' homes
  D. Employees' homes

• Question 360:

  During discussions with an OSC, the assessment team learned that many employees often need to work from remote locations and, as a result, are permitted to access the organization's internal networks from those remote locations.

  To ensure secure remote access requirements are being met, remote access sessions need NOT be:

  A. Validated
  B. Identified
  C. Permitted
  D. Controlled
  A. Validated

  ---

  Explanation

  CMMC Level 2 control AC.L2-3.1.12: Remote Access requires that all methods of remote access be authorized, monitored, and controlled to protect CUI when accessed from external locations. The assessment guide specifies that assessors must verify that remote sessions are identified, permitted, and controlled. There is no requirement for remote access sessions to be "validated" - this is not part of the assessment objectives for this practice.

  Exact extracts:

  "Assessment Objectives... Determine if:- remote access methods are identified;- remote access is authorized prior to allowing such connections;- remote access sessions are controlled; and-cryptographic mechanisms are employed to protect confidentiality and integrity of remote access sessions." "Remote access to organizational systems is accomplished through the use of managed access control points. A detailed record of all remote access sessions is maintained, and the sessions are subject to monitoring and control."

  Why the other options are required:

  Identified (B): OSCs must identify all remote access methods in use.

  Permitted (C): Remote access must be explicitly authorized before it is allowed.

  Controlled (D): Sessions must be controlled (e.g., via encryption, multifactor authentication, and monitoring).

  Validated (A): Not a required assessment objective; it is a distractor option.

  References (CCA documents / Study Guide):

  CMMC Assessment Guide - Level 2, Version 2.13, AC.L2-3.1.12 "Remote Access" (Assessment Objectives; Discussion; Potential Assessment Methods and Objects). NIST SP 800-171 Rev. 2, 3.1.12 (remote access).