Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 371:

  A CCA is offered a significant discount on cybersecurity software from a vendor whose productthey will be evaluating during a CMMC assessment.

  How should the CCA handle this situation according to the CoPC's conflict of interest principle?

  A. Inform the vendor that they can accept such offers only after the CMMC assessment is done.
  B. Accept the discount and disclose it to the C3PAO for transparency.
  C. Decline the discount to avoid any appearance of a conflict.
  D. Recommend the software to the OSC during the assessment, highlighting its value proposition.
  C. Decline the discount to avoid any appearance of a conflict.

• Question 372:

  An OSC processes data in its owned data center. The data center includes a very early smoke detection apparatus (VESDA). The apparatus only captures log information from its sensors around the data center.

  It is not intended, nor capable of, processing CUI. The VESDA is on a separate VLAN and is in a separate locked room in the data center.

  Should the assessor agree that the VESDA is out-of-scope?

  A. Yes. The VESDA is physically and logically separated from the other data center equipment, and it is not intended nor capable of processing CUI.
  B. No. Even though the sensors are out-of-scope, the VESDA could provide access to the outside network if sensors were misused, and CUI could be exfiltrated.
  C. No. Even though the VESDA controller is in a locked room and on a separate VLAN, the VESDA is an essential security function as an early warning system.
  D. Yes. The VESDA serves a non-data processing purpose and is only connected to sensors. Sensors are out-of-scope, so the VESDA is out-of-scope.
  A. Yes. The VESDA is physically and logically separated from the other data center equipment, and it is not intended nor capable of processing CUI.

  ---

  Explanation

  The CMMC Scoping Guidance allows assets to be classified as Out-of-Scope if: They are physically/logically isolated, and They cannot process, store, or transmit CUI.

  Extract:

  "Out-of-Scope assets are those that cannot process, store, or transmit CUI and are physically or logically separated from CUI assets."

  The VESDA system only monitors environmental conditions and does not interact with CUI. Its segregation supports an out-of-scope classification.

• Question 373:

  John, a Certified CMMC Assessor, has been conducting CMMC assessments for several years. During a recent assessment at a defense contractor, he encountered several issues similar to challenges he had faced in previous assessments. Influenced by his past experiences, John's interpretation of the contractor's practices was shaped by his preconceptions.

  Which of the following is TRUE about John's interpretation?

  A. John's bias has no impact on the integrity of the assessment
  B. John's bias can affect the integrity of the CMMC assessment
  C. John's experience ensures that all assessments will be unbiased and accurate
  D. John's preconceptions help streamline the assessment process and ensure consistency
  B. John's bias can affect the integrity of the CMMC assessment

• Question 374:

  An OSC seeking Level 2 certification is reviewing the physical security of their building. Currently, the building manager unlocks and locks the doors for business operations. The OSC would like the ability to automatically unlock the door for authorized personnel, track access individually, and maintain access history for all personnel.

  The BEST approach is for the OSC to:

  A. Maintain a list of authorized personnel and assign them a building key.
  B. Maintain security cameras to continuously monitor access to the building.
  C. Install a badge system and require each individual to use their badge to gain entry to the building.
  D. Install a keypad system and require the entry code to be changed when an individual leaves the company.
  C. Install a badge system and require each individual to use their badge to gain entry to the building.

  ---

  Explanation

  CMMC Level 2 requires the ability to control and monitor physical access to systems and facilities containing CUI. The best practice is a badge-based access control system, which provides individual accountability, access tracking, and historical audit records. Keys and keypads do not provide individual traceability. Cameras alone do not prevent unauthorized entry.

  Exact Extracts (official CMMC Assessor/Study documents):

  PE.L2-3.10.1: "Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals." PE.L2-3.10.3: "Escort visitors and monitor visitor activity." PE.L2- 3.10.5: "Access records must be maintained." CMMC Assessment Guide clarifies that acceptable methods include badging systems with individual accountability for traceability.

  Why the other options are not correct:

  Option A (keys): Keys do not provide audit logs or individual accountability.

  Option B (cameras): Monitoring alone is insufficient; prevention and control are required.

  Option D (keypads): Shared codes do not provide unique traceability or access history per user.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: PE.L2 practices (pp. 153-159).

  NIST SP 800-171A, Physical and Environmental Protection (PE) assessment objectives.

• Question 375:

  An OSC seeking Level 2 certification is migrating to a fully cloud-based environment. The organization wants to select a Cloud Service Provider (CSP) that can share responsibilities for CMMC Level 2 requirements. Assume both CSPs can equally provide the technical capabilities and business value required.

  CSP A has SOC 2 certification and is California Consumer Privacy Act (CCPA) and Health Insurance Portability and Accountability Act (HIPAA) compliant.

  CSP B has SOC 2 and FedRAMP Moderate certifications.

  Based on this information, which CSP is MOST LIKELY to be acceptable?

  A. CSP A
  B. CSP B
  C. Both CSP A and B
  D. Neither CSP A nor B
  B. CSP B

  ---

  Explanation

  When an OSC leverages cloud providers in a CMMC Level 2 assessment, the provider should have FedRAMP Moderate or higher authorization to align with NIST SP 800-171 requirements. SOC 2, HIPAA, or CCPA compliance do not demonstrate federal-level assurance for protecting CUI. Thus, CSP B is the most appropriate choice.

  Exact extracts:

  "Cloud service providers that process, store, or transmit CUI should be FedRAMP Moderate Authorized or equivalent." "Assessors must verify evidence of FedRAMP authorization or comparable assurance before determining that OSC reliance on the provider is acceptable."

  Why the other options are incorrect:

  Option A: SOC 2, HIPAA, and CCPA compliance do not equate to CMMC-required federal assurance.

  Option C: Only FedRAMP-authorized providers meet the requirement, so both are not acceptable.

  Option D: CSP B does meet the criteria.

• Question 376:

  An assessor is reviewing whether an organization appropriately analyzed the security impact of a new release of an application.

  Which of the following documents is MOST useful for the assessor to review?

  A. A description of the change from the software vendor
  B. Change Control Board (CCB) meeting minutes and supporting documents
  C. System audit logs showing that the change occurred, when, and by whom
  D. A log of security incidents/issues after the change was implemented
  B. Change Control Board (CCB) meeting minutes and supporting documents

  ---

  Explanation

  Applicable Requirement: CM.L2-3.4.3 -"Track, review, approve/disapprove, and audit changes to organizational systems."

  Why CCB Minutes Are Correct (supports B): Change Control Board (CCB) documentation includes impact analyses, approvals, disapprovals, and justification for system changes. The CMMC Assessment Guide explicitly identifies CCB minutes and supporting records as primary evidence of compliance with change management practices.

  Why Other Options Are Insufficient:

  Option A (Vendor description): Provides information on the update, but does not show organizational review or approval.

  Option C (Audit logs): Show when a change occurred, but not whether it was analyzed and approved beforehand.

  Option D (Incident logs): Reflects results after implementation, but not the review/approval process.

  Assessment Guidance Extract (NIST SP 800-171A, CM.L2-3.4.3):

  Objectives include verifying that system changes are: Documented Reviewed Approved/disapproved, and Audited.

  Evidence such as CCB minutes and approval records directly satisfies these objectives.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - CM.L2-3.4.3 (Change Management) NIST SP 800-171A - Assessment Objectives for CM.L2-3.4.3 CMMC Assessment Guide - Level 2, Version 2.13 - Change Management evidence expectations

• Question 377:

  CMMC MA.L2-3.7.6 - Maintenance Personnel requires that maintenance personnel without required access authorization be supervised during maintenance activities. One of the ways organizations can achieve this is to develop a documented procedure for supervised maintenance activities.

  Which of the following elements should be excluded from the documented procedure?

  A. A detailed list of all CUI assets that the maintenance activity might impact
  B. The specific steps authorized for the visiting maintenance personnel with limited access
  C. Contact information for the organization's IT security team in case of emergencies or unexpected issues
  D. The method used to authenticate and monitor the supervisor's activity during the maintenance session
  A. A detailed list of all CUI assets that the maintenance activity might impact

• Question 378:

  An engineering company works on DoD contracts that involve handling CUI. They use hard-copy media, such as printed paper and microfilms, and digital media, including flash drives, SSDs, DVDs, and internal and external hard drives. During a CMMC assessment, you discover that the engineering company has defined procedures addressing media storage and access governed by an access control policy. All media containing CUI are marked and stored in biometrically locked cabinets. To store CUI on digital media, an authorized user must be identified using their biometrics or authenticated using an integrated MFA solution. To access non-digital media, the user must be on a defined list of authorized personnel and sign three forms. You also learn that the contractor maintains a comprehensive inventory of all CUI media.

  Based on the scenario, how would you score the contractor's implementation of CMMC practice MP.L2- 3.8.1 - Media Protection?

  A. Partially Met
  B. Not Applicable
  C. Not Met
  D. Met
  D. Met

• Question 379:

  During a CMMC assessment, an OSC employee tells the CCA that they don't follow a documented procedure because "it's outdated," but they have an informal process that works better. The informal process appears to meet the practice's objectives.

  How should the CCA proceed?

  A. Accept the informal process as evidence and score the practice as "MET."
  B. Document the discrepancy between the documented procedure and the informal process as an evidence gap and assess based on all evidence.
  C. Score the practice as "NOT MET" because the documented procedure is not followed.
  D. Request the OSC to update the documented procedure to reflect the informal process.
  B. Document the discrepancy between the documented procedure and the informal process as an evidence gap and assess based on all evidence.

• Question 380:

  Ron is the Lead Assessor for an OSC's CMMC assessment. His team has scheduled interviews and demonstrations with the OSC's system administrator, Olivia. However, on the first day, the CEO informs Ron that Olivia is very ill and is unavailable. The CEO offers to be interviewed about Olivia's responsibilities instead, even though he does not actually perform those tasks.

  What should Ron do in this scenario?

  A. Have the CEO accompanied by another IT rep during the interview.
  B. Interview the CEO.
  C. It depends on the specific details discussed during the interview with the CEO.
  D. Reschedule the interviews with Olivia or continue with another person who understands and performs Olivia's duties while she is away.
  D. Reschedule the interviews with Olivia or continue with another person who understands and performs Olivia's duties while she is away.