Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 381:

  A company has a firewall to regulate how data flows into and out of its network. Based on an interview with their IT staff, all connections to their systems are logged, and suspicious traffic generates alerts.

  Examination of which artifact should give the CCA the details on how these are implemented?

  A. Physical access logs
  B. Boundary protection procedures
  C. Account management document
  D. Configuration management policy
  B. Boundary protection procedures

  ---

  Explanation

  The control SC.L2-3.13.5: Boundary Protection requires that organizations monitor and control communications at the external boundary and at key internal boundaries. The CMMC Assessment Guide states that assessors should examine boundary protection procedures to verify logging, monitoring, and alerting are defined and implemented. Physical access logs, account management documents, and configuration management policies do not provide details of how network boundaries are monitored and protected.

  Exact extracts:

  "Assessment Objectives... Determine if: - external boundary and key internal boundaries are defined; - communications are monitored and controlled at boundaries; - traffic is checked for unauthorized transfer of information; and - boundary protection devices are configured and managed."

  "Potential Assessment Methods: Examine... boundary protection policy; boundary protection procedures;

  system security plan; configuration settings for boundary protection devices; logs of boundary protection devices."

  Why the other options are incorrect:

  Option A (Physical access logs): Relates to facility entry, not network boundary protection.

  Option C (Account management document): Addresses user account lifecycle, not firewall and traffic control.

  Option D (Configuration management policy): Governs system changes, not firewall logging/alerting controls.

  References (CCA documents / Study Guide):

  CMMC Assessment Guide - Level 2, SC.L2-3.13.5 "Boundary Protection."

  NIST SP 800-171 Rev. 2, 3.13.5.

• Question 382:

  While conducting an assessment, an assessor is determining if privileged accounts are used for non-privileged functions.

  While interviewing a user with a privileged account, the assessor should ask if the person interviewed:

  A. Knows which other users have privileged accounts
  B. Is knowledgeable of role-based access control privileges
  C. Uses their privileged account to research vulnerabilities on the Internet
  D. Can show how IT staff provision privileged and non-privileged accounts
  C. Uses their privileged account to research vulnerabilities on the Internet

  ---

  Explanation

  To verify compliance with AC.L2-3.1.5 (Least Privilege), the assessor must confirm that privileged accounts are not used for routine or non-privileged tasks. Asking if a user uses their privileged account for tasks like researching vulnerabilities on the Internet directly tests whether the principle of least privilege is being followed.

  Exact Extracts:

  AC.L2-3.1.5: "Employ the principle of least privilege, including for specific security functions and privileged accounts." CMMC Assessment Guide: "Interviews should confirm that privileged accounts are used exclusively for privileged functions, and that standard accounts are used for general tasks." NIST SP 800-171A

  Objective: "Determine through interviews whether users employ privileged accounts for non-privileged tasks." Why other options are not correct:

  Option A: Awareness of other privileged users is not the issue being assessed.

  Option B: Knowledge of RBAC is useful but does not confirm account usage practices.

  Option D: Provisioning procedures are an IT staff responsibility, not a user behavior check.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: AC.L2-3.1.5 (pp. 17-19).

  NIST SP 800-171Option A: Assessment procedures for least privilege.

• Question 383:

  CMMC practice MA.L2-3.7.3 - Equipment Sanitization requires organizations to sanitize equipment leaving their facilities for off-site maintenance for CUI.

  What standard would the OSC use to sanitize various media?

  A. NIST SP 800-53
  B. NIST SP 800-88
  C. NIST SP 800-171
  D. NIST SP 800-171A
  B. NIST SP 800-88

• Question 384:

  You are the Lead Assessor for a CMMC Level 2 Assessment of an OSC. During Phase 1 planning, the OSC's Assessment Official informs you that several key personnel who manage the in-scope IT systems will be unavailable during the scheduled assessment dates due to a company-wide training event. The Assessment Official asks if the assessment can proceed with substitute personnel who are less familiar with the systems.

  What should you do?

  A. Proceed with the assessment using the substitute personnel, as long as they can provide some information about the systems.
  B. Agree to proceed but request that the OSC provide written documentation to compensate for the unavailable personnel.
  C. Reschedule the assessment to a time when the key personnel are available, as their participation is critical for an accurate assessment.
  D. Conduct the assessment virtually to accommodate the unavailable personnel.
  C. Reschedule the assessment to a time when the key personnel are available, as their participation is critical for an accurate assessment.

• Question 385:

  The OSC POC has supplied all of the procedures, policies, and plans at the start of the assessment. One of the assessors notes that some of the documents have very recent approval dates, while others have been in place for several years based on the document history.

  In order to ensure the review of this evidence is sufficient, what is the BEST step to validate the sufficiency of these documents?

  A. Examine the documents to determine if they are complete.
  B. Examine if the procedure in question replaced another document.
  C. Interview OSC team members who should be using the procedure.
  D. Interview people who hold leadership roles named in the documents.
  C. Interview OSC team members who should be using the procedure.

  ---

  Explanation

  The Interview assessment method is used to validate whether procedures and policies are actually being implemented and followed by the personnel who use them. Even if the documents are dated correctly, assessors must confirm their operational use.

  Extract:

  "Interviews with personnel are used to verify that documented policies, plans, and procedures are actually implemented in daily practice."

  Thus, interviewing OSC team members who use the procedures provides the strongest validation.

  References:

  CMMC Assessment Process (CAP) Assessment Methods (Examine, Interview, Test, Observe).

• Question 386:

  A CCA is prohibited from doing which of the following?

  A. Verifying key internal system boundaries
  B. Determining if physically separated assets contain CUI
  C. Ensuring the external system boundary is fully defined
  D. Examining whether communications are monitored at the external system boundary
  B. Determining if physically separated assets contain CUI

  ---

  Explanation

  The OSC is responsible for identifying and declaring where CUI is processed, stored, or transmitted. A Certified CMMC Assessor (CCA) may verify boundaries, examine evidence, and confirm monitoring or control practices, but cannot independently determine if a physically separated asset contains CUI. That determination is the responsibility of the OSC, not the assessor.

  Exact extracts:

  "The OSC is responsible for identifying CUI assets."

  "Assessors verify and validate the OSC's identification, but do not independently declare or determine the presence of CUI." "Assessors are permitted to examine boundary protections, monitoring mechanisms, and internal boundary controls."

  Why the other options are allowed:

  Option A: Assessors are required to verify internal system boundaries.

  Option C: Assessors must confirm that external system boundaries are clearly defined.

  Option D: Assessors must examine evidence of communication monitoring.

  References (CCA documents / Study Guide):

  CMMC Assessment Guide - Level 2, Assessor Roles and Responsibilities.

  CMMC Code of Professional Conduct (OSC retains CUI ownership; assessors validate but cannot declare CUI).

• Question 387:

  During an assessment, you learn that a cybersecurity firm helped the OSC prepare for the assessment. In an attempt to learn more about this firm, the OSC POC gives you their name. Performing a quick search, you learn they aren't listed in the Cyber AB marketplace.

  What should you do as the Lead Assessor?

  A. Ignore it and continue with the assessment.
  B. Confront the RPO about this unethical behavior.
  C. Discontinue the assessment.
  D. Inform the OSC that the RPO isn't registered and report this to Cyber AB through your C3PAO.
  A. Ignore it and continue with the assessment.

• Question 388:

  A contractor allows for the use of mobile devices in contract performance. Some employees access designs and specifications classified as CUI on such devices like tablets and smartphones. After assessing AC.L2-3.1.18 - Mobile Device Connection, you find that the contractor maintains a meticulous record of mobile devices that connect to its information systems. AC.L2-3.1.19 - Encrypt CUI on Mobile, requires that the contractor implements measures to encrypt CUI on mobile devices and mobile computing platforms. The contractor uses device-based encryption where all the data on a mobile device is encrypted.

  Which of the following personnel should you interview to determine how well the contractor has implemented AC.L2-3.1.19 - Encrypt CUI on Mobile?

  A. Executives in the company
  B. Personnel with access control responsibilities for mobile devices
  C. IT helpdesk staff who troubleshoot basic mobile device issues
  D. Staff in the Human Resources department
  B. Personnel with access control responsibilities for mobile devices

• Question 389:

  A Lead Assessor is conducting an assessment for an OSC. The OSC is currently using doors and badge access to limit access to private areas of their campus to only authorized personnel.

  Which item is another means of controlling physical access to areas that contain CUI?

  A. Guards
  B. Cameras
  C. Firewalls
  D. Partition walls
  A. Guards

  ---

  Explanation

  Applicable Requirement: PE.L2-3.10.3 -"Control physical access to organizational systems, equipment, and the respective operating environments."

  Why Option A is Correct: Security guards are a recognized preventive and detective physical control to limit access to only authorized individuals. Guards can verify credentials, monitor behavior, and provide real-time deterrence.

  Why Other Options Are Insufficient:

  Option B (Cameras): Provide monitoring and evidence, but not direct access control.

  Option C (Firewalls): A network control, not a physical access measure.

  Option D (Partition walls): Barriers may help physically separate areas but do not control who enters.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - PE.L2-3.10.3 NIST SP 800-171A - PE.L2-3.10.3 Assessment Objectives

  CMMC Assessment Guide - Level 2 - Physical Security Controls

• Question 390:

  The OSC has not implemented cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission, citing the use of alternative physical safeguards.

  Which of the following is NOT an alternative physical safeguard in this scenario?

  A. Trusted couriers
  B. Lockable casings
  C. Physical access site monitoring
  D. Tamper protections technologies
  D. Tamper protections technologies

  ---

  Explanation

  Acceptable physical safeguards in lieu of encryption (in limited cases) include trusted couriers, locked containers, and monitored physical transport. "Tamper protection technologies" are not recognized as an acceptable alternative safeguard for protecting CUI in transit.

  Extract:

  "Physical safeguards such as trusted couriers, locked containers, and controlled site monitoring may substitute for cryptographic protections when encryption is not feasible. Other measures not defined (e.g., tamper protection) do not satisfy the requirement."

  Thus, is NOT an acceptable safeguard.D

  References:

  CMMC Assessment Guide - Level 2, SC.L2-3.13.8.