Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 391:

  During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team.

  Can the Lead Assessor proceed with the assessment using a reduced assessment team size?

  A. Yes, as long as the remaining team members possess the necessary qualifications to cover all CMMC practices.
  B. Yes, but only with the express written consent of the Cyber AB.
  C. The decision is solely up to the OSC.
  D. No, the assessment must be postponed until the full team is available.
  A. Yes, as long as the remaining team members possess the necessary qualifications to cover all CMMC practices.

• Question 392:

  A CCA is assessing the implementation of the Incident Reporting practice.

  To validate the control, what MUST the CCA ensure about the OSC?

  A. Incidents are tracked and documented
  B. Incident sources are configured and tuned
  C. Law enforcement officials are automatically notified during an incident
  D. Forensic investigations are performed to determine the impact of the incident
  A. Incidents are tracked and documented

  ---

  Explanation

  Applicable Requirement: IR.L2-3.6.1 -"Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities."

  Validation Expectation: For this practice, the CCA must confirm that the OSC: Tracks incidents consistently, Documents incident details (who, what, when, where, and how), and Maintains incident records to support analysis and corrective action.

  Why Option A is Correct: Tracking and documenting incidents demonstrates that the OSC has an operational incident-handling capability and provides objective evidence of detection, response, and lessons learned.

  Why Other Options Are Insufficient:

  Option B (Sources configured/tuned): Helpful for detection, but not sufficient by itself.

  Option C (Law enforcement notified): This may occur in certain cases, but it is not required by CMMC Level 2.

  Option D (Forensics): Deep forensic investigation may be useful, but CMMC requires incident response capability, not mandatory forensic-level activities.

  References (CCA Official Sources): NIST SP 800-171 Rev. 2 - IR.L2-3.6.1 NIST SP 800-171A - IR.L2-3.6.1 Assessment Objectives (tracking, documenting, handling incidents) CMMC Assessment Guide - Level 2 - Incident Repoting

• Question 393:

  A company has five individual buildings in one business complex. During the assessment, the Assessment Team sees people entering and exiting the buildings and notices that none of the buildings have keypads or locks. The Assessment Team needs to determine how physical access is managed and controlled.

  Which artifact BEST describes how access to these buildings is managed?

  A. System Security Plan (SSP)
  B. Personnel Access List
  C. Identification and Authorization Plan
  D. Physical and Environmental Protection Policy
  D. Physical and Environmental Protection Policy

  ---

  Explanation

  The Physical and Environmental Protection (PE) Policy is the governing artifact that describes how physical access to facilities and environments is managed and controlled. While the SSP provides a system-wide overview, and access lists provide details of who is authorized, it is the PE Policy that explicitly documents the physical access control measures required under CMMC.

  Extract from PE.L2-3.10.1: "Organizations must develop, document, and disseminate physical and environmental protection policies that govern how access to buildings and systems containing CUI is limited to authorized individuals."

  References:

  CMMC Assessment Guide - Level 2, PE.L2-3.10.1.

• Question 394:

  FIPS-validated cryptography is required to meet CMMC practices that protect CUI when transmitted or stored outside the OSC's CMMC enclave.

  What source does the CCA use to verify that the cryptography the OSC has implemented is FIPS-validated?

  A. Cryptographic section of the OSC's SSP
  B. Vendor cryptographic module documentation
  C. NIST Module Validation Program
  D. Cryptographic section of the Shared Responsibility Matrix
  C. NIST Module Validation Program

  ---

  Explanation

  The CMMC practices for cryptographic protection (SC.L2-3.13.11, SC.L2-3.13.8, etc.) require that cryptography protecting CUI must be FIPS-validated. The authoritative source for validation is the NIST Cryptographic Module Validation Program (CMVP).

  Extract:

  "To use cryptography in compliance with CMMC requirements, organizations must use modules validated under the NIST Cryptographic Module Validation Program (CMVP). The CMVP is the authoritative source to verify whether a cryptographic implementation is FIPS-validated."

  Vendor documentation or SSP claims alone cannot serve as authoritative proof. The CCA must consult the NIST CMVP validation list.

  References:

  CMMC Assessment Guide - Level 2 SC.L2-3.13.11, SC.L2-3.13.8 CMVP Guidance.

• Question 395:

  As a CCA, understanding the guiding principles of the CoPC can help you when you face situations in which you are asked to compromise your values and integrity.

  Which of the following is NOT a guiding principle of the CoPC?

  A. Confidentiality
  B. Professionalism
  C. Availability
  D. Proper Use of Methods
  C. Availability

• Question 396:

  You are a CCA on an Assessment Team conducting a CMMC Level 2 assessment. The OSC provides evidence for a practice that includes a log file, but the file is corrupted and cannot be opened. The OSC claims the log proves compliance but cannot provide a readable copy during the assessment.

  What should you do?

  A. Accept the OSC's claim and score the practice as "MET" based on their assurance.
  B. Document the corrupted file as an evidence gap and assess the practice based on other available evidence.
  C. Score the practice as "NOT MET" due to the lack of readable evidence.
  D. Request the OSC to recover the log file and provide a readable copy before continuing.
  B. Document the corrupted file as an evidence gap and assess the practice based on other available evidence.

• Question 397:

  A company seeking Level 2 certification has several telecommunications closets throughout its office building. The closets contain network systems and devices that are used to transmit CUI.

  Which method would be BEST to ensure that only authorized personnel can access the network systems and devices housed within the closets?

  A. Label the door with "Authorized Personnel Only" and maintain an authorized personnel list.
  B. Install locks with badge readers on the closet doors and maintain an authorized list.
  C. Install security cameras to monitor closet entrances and maintain an authorized personnel list.
  D. Install keypad door locks on the closet doors and only provide the code to IT department personnel.
  B. Install locks with badge readers on the closet doors and maintain an authorized list.

  ---

  Explanation

  CMMC requires physical access to systems containing or transmitting CUI to be limited to authorized individuals and for access records to be maintained. Badge readers with unique identification provide individual accountability, access control enforcement, and auditable access logs, which are stronger than labels, cameras, or keypads.

  Exact Extracts:

  PE.L2-3.10.1: "Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals." PE.L2-3.10.5: "Maintain audit logs of physical access."

  CMMC Assessment Guide: "Badge systems with access control lists and logs are considered a best method for meeting physical access requirements."

  Why the other options are not correct:

  Option A: Labels and lists do not prevent unauthorized access.

  Option C: Cameras monitor but do not restrict access; they are detective, not preventive.

  Option D: Keypads do not provide individual accountability (codes can be shared).

• Question 398:

  A CCA receives a notification from the Cyber AB that they are being investigated for a potential violation of the CoPC. They are concerned about the potential consequences and want to understand the process better.

  Who has the final authority to determine the corrective action taken against a CCA, if any?

  A. The investigator assigned to the CCA's case.
  B. The CMMC Accreditation Body (the Cyber AB).
  C. The C3PAO.
  D. The Lead Assessor.
  B. The CMMC Accreditation Body (the Cyber AB).

• Question 399:

  A defense contractor has a complex network design with multiple VLANs. The network is divided into three VLANs: VLAN 10 for the administrative offices, VLAN 20 for the engineering department, and VLAN 30 for

  the manufacturing floor. The company's System Security Plan states that VLANs are used to create logical network segments and improve security. A Layer 3 switch is responsible for routing traffic between the VLANs, and the switch is configured to allow any type of traffic between the VLANs.

  How should VLANs be treated when defining the contractor's CMMC Assessment Scope?

  A. Do not include any VLAN in the CMMC assessment scope.
  B. Include them in the CMMC Assessment Scope.
  C. Include only VLAN 30 in the CMMC assessment scope as it directly interacts with CUI.
  D. Include only VLAN 20 and VLAN 30 in the assessment scope.
  B. Include them in the CMMC Assessment Scope.

• Question 400:

  The Lead Assessor is reviewing the Assessment Plan to identify people for interviews regarding a specific Level 2 practice. Some OSC personnel previously interviewed provided only brief answers without meaningful verification.

  What can the Lead Assessor do to improve this situation going forward?

  A. Ensure the people from the training matrix are made available
  B. Ensure and verify confidentiality and non-attribution of responses
  C. Ensure the respondents sign a non-disclosure agreement for the OSC
  D. Ensure and verify the responses map to the documented artifacts
  B. Ensure and verify confidentiality and non-attribution of responses

  ---

  Explanation

  The CMMC Assessment Process emphasizes the importance of confidentiality and non-attribution in interviews to ensure OSC personnel provide candid, accurate information. Interviewees may give shallow or evasive answers if they fear attribution. Assuring confidentiality and non-attribution improves the quality and reliability of responses.

  Exact extracts:

  "The assessment team must ensure confidentiality and non-attribution during interviews." "Responses should be validated against evidence, but the quality of input depends on establishing a safe environment for candor." "Non-attribution is critical to elicit detailed and honest responses."

  Why the other options are incorrect:

  Option A: Training matrices identify who is trained, not who should be interviewed.

  Option C: NDAs are not a CCA responsibility - they are contractual, not assessment requirements.

  Option D: Mapping to artifacts is part of correlation after interviews, but does not solve the problem of poor interview responses.

  References:

  CMMC Assessment Process (CAP), interview methodology.

  CCA Exam Study Guide, section on interviews.