Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 361:

  Sarah, a Certified CMMC Assessor, is conducting an assessment for DataSecure, a cloud service provider that hosts various applications for the Defense Industrial Base (DIB). During the assessment, Sarah encounters a complex and highly specialized cloud architecture that leverages cutting-edge technologies such as containerization, serverless computing, and advanced security controls. As Sarah reviews the evidence provided by DataSecure for the relevant CMMC practices, she realizes that some of the evidence and implementations are unlike anything she has encountered in previous assessments.

  What is the most appropriate action for Sarah to take as a CCA in this scenario?

  A. Request DataSecure to simplify their architecture and align with more traditional IT practices for easier evaluation.
  B. Strictly adhere to a standardized assessment checklist, regardless of DataSecure's unique architecture.
  C. Defer the assessment until she can receive additional training on the specific technologies used by DataSecure.
  D. Thoroughly research and understand DataSecure's cloud architecture, seek clarification from subject matter experts, and evaluate the evidence within the context of their specialized environment.
  D. Thoroughly research and understand DataSecure's cloud architecture, seek clarification from subject matter experts, and evaluate the evidence within the context of their specialized environment.

• Question 362:

  Before an OSC categorizes its assets into different categories, it must determine the scope of applicability.

  However, after discussing with the OSC's Point of Contact (PoC), you learn that although they follow CUI and FCI in all forms and stages, they are mostly considered technical components.

  What is the issue with the OSC's approach to determining the scope of applicability?

  A. The OSC's approach might result in too many CUI assets.
  B. The OSC's approach focuses on saving money by narrowing the scope.
  C. The OSC's approach may result in a scope that is too broad for the assessment.
  D. They have fallen into the "technical system" trap.
  D. They have fallen into the "technical system" trap.

• Question 363:

  A leading technology solutions provider that works with various government agencies and commercial clients has implemented a dedicated CUI enclave within its network infrastructure to ensure the secure handling of CUI. As a Certified CMMC Assessor, you are tasked with assessing the scope of the solutions provider's CMMC requirements.

  Which separation technique can the technology solutions provider use to isolate the network assets in its CUI enclave?

  A. Physical separation
  B. Segmentation
  C. Logical isolation
  D. Encryption
  C. Logical isolation

• Question 364:

  You are part of an Assessment Team tasked with conducting a CMMC assessment for an OSC. When assessing the contractor's implementation of SC.L2-3.13.6 - Network Communication by Exception, objectives [a] and [b], the OSC's system administrator informs you that they use a Fortinet Next-Generation Firewall (NGFW). Fortinet NGFWs are hard-coded to deny all traffic by default, and traffic is only allowed on an exception basis. While this is factual, the Lead Assessor asks you to test the NGFW to determine whether it meets the intent of the assessment objectives in SC.L2-3.13.6 - Network Communication by Exception.

  What is the benefit of testing as an assessment method?

  A. Testing helps determine if CMMC practices are implemented and whether adequate resources were provided to the individuals performing the practices.
  B. Testing allows you to observe what has been done and what has not been done.
  C. Testing allows you to determine if the OSC has the intent to meet the Assessment Objectives.
  D. Testing provides insight into the OSC's handling of CMMC practices.
  B. Testing allows you to observe what has been done and what has not been done.

• Question 365:

  A mid-sized company specializing in machining is preparing to bid for an upcoming DoD contract to provide machined components crucial for defense systems. As CMMC compliance will be required, the company's top executives have invited you to assess their implementation of CMMC Level 2 requirements.

  During your visit to their environment of operations, you discover that its production floor has several Computer Numerical Control (CNC) machines for precision machining, which are all connected to a local network for data transfer and control. The CNC machines receive design files from a central server in the company's data center and communicate with a SCADA quality control system that monitors production metrics and performance. The central server hosts the design files, which are only accessible to authorized engineers and operators and backed up in an Amazon EBS cloud instance to ensure availability across the company's multiple machining shops in different states. Furthermore, the company allows employees to upload designs to the server remotely using VPNs and virtual desktop instances.

  What is the BEST physical control the company can use for preventive purposes?

  A. Using proximity card readers
  B. Installing CCTVs
  C. Displaying a large banner written "Authorized Personnel Only"
  D. Locking all entrances
  A. Using proximity card readers

• Question 366:

  When assessing a contractor's implementation of CMMC requirements, you realize they have multiple data centers and regional offices, each having its access control mechanisms and security perimeter. The contractor uses a remote access solution to allow external partners and employees to collaborate on projects that involve CUI. The solution requires routing configuration to ensure the remote access to CUI is not compromised.

  Why should all traffic be routed through a managed Access Control point?

  A. It simplifies network architecture and reduces complexity
  B. Reduces the susceptibility to unauthorized access to organizational systems
  C. It enables easier troubleshooting and monitoring of network traffic
  D. It provides better performance and lower latency for remote users
  B. Reduces the susceptibility to unauthorized access to organizational systems

• Question 367:

  An organization has contracted with a third party for system maintenance and support. The third-party personnel all work remotely.

  Which of the following should an assessor assure is in place?

  A. Only third-party personnel can perform system maintenance functions.
  B. Third-party personnel need to be identified and monitored while performing maintenance.
  C. The number of third-party personnel who can access the organization's systems concurrently is limited.
  D. Remote access to systems used by the third party for maintenance functions is terminated automatically based on a defined set of criteria.
  D. Remote access to systems used by the third party for maintenance functions is terminated automatically based on a defined set of criteria.

  ---

  Explanation

  CMMC requires that remote maintenance sessions be terminated after use or after a defined period of inactivity. This ensures third-party maintenance access does not remain open and uncontrolled, preventing unauthorized persistence.

  Exact Extracts:

  MA.L2-3.7.5: "Require multifactor authentication and terminate remote maintenance sessions after each session or after a defined period of inactivity." Assessment Guide clarifies: "Assessors should confirm remote maintenance sessions are automatically terminated using technical means." NIST SP 800-171A Objective: "Test maintenance session termination after a set time of inactivity or completion of task."

  Why other options are not correct:

  Option A: Limiting maintenance to third parties only is not a requirement. Internal staff may also perform maintenance.

  Option B: Identification and monitoring are important, but the specific control required here is termination of remote sessions.

  Option C: Limiting the number of personnel is not mandated by CMMC.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: MA.L2-3.7.5 (pp. 147-149).

  NIST SP 800-171Option A: Maintenance domain assessment procedures.

• Question 368:

  You are part of the Assessment Team evaluating an OSC's implementation of AC.L2- 3.1.13 - Remote Access Confidentiality. This requirement mandates the organization to employ cryptographic mechanisms to protect the confidentiality of remote access sessions. During your assessment, you want to determine whether these cryptographic mechanisms have been properly identified as required by assessment objective [a].

  What specification can you use to make this determination?

  A. Interviews with security administrators
  B. Interviews of personnel responsible for remote access
  C. Remote access authorizations
  D. The organization's Access Control Policy and Procedures and system design documentation
  D. The organization's Access Control Policy and Procedures and system design documentation

• Question 369:

  During an assessment, the OSC was found to have implemented 68% of CMMC practice SC.L2-3.13.11 - CUI Encryption. However, the OSC Assessment Official cited issues with the vendor for not fully implementing the practice. Nonetheless, it has been listed in their POA&M.

  Which of the following is true regarding the use of a POA&M during a CMMC assessment?

  A. A POA&M addressing unimplemented security requirements is not a substitute for a completed CMMC practice
  B. A POA&M can be used as evidence of full implementation for any unimplemented CMMC practices
  C. If a practice is listed in the POA&M, it is considered fully implemented during the assessment
  D. Assessors are required to accept any POA&M as evidence of implementation for partially implemented practices
  A. A POA&M addressing unimplemented security requirements is not a substitute for a completed CMMC practice

• Question 370:

  You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company's network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts.

  If the OSC insists on excluding the subsidiary's network and assets from the CMMC Assessment Scope despite your recommendation to include them, what should you do?

  A. Terminate the Assessment engagement and take further steps to resolve the disagreements.
  B. Escalate the issue to the CMMC Accreditation Body for further guidance and resolution.
  C. Proceed with the Assessment based on the OSC's proposed scope, as the OSC has the final authority to determine the scope.
  D. Include the subsidiary's network and assets in the CMMC Assessment Scope without the OSC'sconsent, as the Lead Assessor has the final authority to determine the scope.
  A. Terminate the Assessment engagement and take further steps to resolve the disagreements.