Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 401:

  A Lead Assessor is conducting an assessment for an OSC. The Lead Assessor is collecting evidence regarding the OSC's network separation techniques.

  Which technique would be considered a logical separation technique and would fall within the scope of the assessment?

  A. Data loss alerting configured at the edge of the network containing CUI assets
  B. Access limitation based on badge access assigned to employees based on role
  C. Role-based access control within a properly implemented identity and access management tool
  D. A proxy-configured firewall that prevents data from flowing along the physical connection path
  C. Role-based access control within a properly implemented identity and access management tool

  ---

  Explanation

  Logical separation refers to the use of technical and access control mechanisms (e.g., role-based access, IAM tools, VLANs) to enforce boundaries between different users, roles, or networks. In contrast, physical separation relies on distinct hardware or physical barriers. Role-based access control within an IAM solution is a textbook example of logical separation, and it is specifically called out in the CMMC/NIST context.

  Exact extracts:

  "Logical separation may be achieved through the use of virtualization, encryption, or access control mechanisms such as role-based access controls." "Assessment Objectives... Determine if: - separation of users and information types is enforced by physical or logical means." "Logical separation is implemented using technical solutions such as access control lists, firewalls configured by policy, or identity and access management solutions."

  Why the other options are incorrect:

  Option A (Data loss alerting): This is monitoring, not separation.

  Option B (Badge access): This is a physical access control, not logical separation.

  Option D (Proxy-configured firewall): This is boundary protection/traffic control; depending on setup it may be physical or logical, but the scenario points to role-based IAM as the logical example.

  References (CCA documents / Study Guide):

  CMMC Assessment Guide - Level 2, SC.L2-3.13.6 "Network Separation."

  NIST SP 800-171 Rev. 2, 3.13.6.

• Question 402:

  While conducting a CMMC Level 2 Third-Party Assessment of a small defense contractor, an assessor discovers that the contractor's Information Security Policy has no documented change records demonstrating executive approval. The IT director states that they will add change records in the future, but that other evidence exists.

  Which documentation is MOST able to demonstrate persistent and habitual adherence to CMMC requirements?

  A. Handwritten notes from executive committee meetings discussing implementation
  B. Several years' worth of saved emails from the executive team approving policies and directing adherence
  C. A notarized letter from the previous CEO stating that they approved information security policies annually
  D. Transcribed interviews with new employees discussing their understanding of information security policies
  B. Several years' worth of saved emails from the executive team approving policies and directing adherence

  ---

  Explanation

  Applicable Requirement: CA.L2-3.12.4 -"Develop, document, periodically review/update, and disseminate system security plans." Policies require executive approval and evidence of regular review.

  Why B is Correct: Multiple years of emails from executives approving policies provide a pattern of consistent executive involvement, demonstrating habitual compliance with review and approval requirements. This is stronger evidence than one-time or informal attestations.

  Why Other Options Are Insufficient:

  Option A: Handwritten notes are informal and lack authenticity controls.

  Option C: A notarized letter from a previous CEO is a one-time attestation, not evidence of recurring review.

  Option D: Employee interviews may demonstrate awareness but do not show executive approval.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - CA.L2-3.12.4 NIST SP 800-171A - CA.L2-3.12.4 Assessment Objectives (evidence of policy review/approval) CMMC Assessment Guide - Level 2 - Policy and Approval Evidence Requirements

• Question 403:

  A contractor is preparing to bid on an upcoming DoD contract to provide next-generation upper limb prosthetics for injured servicemen. Part of the preparation is undergoing a CMMC assessment, and they have hired you to assess their implementation of CMMC practices. The contractor has multiple design, manufacturing, and supply chain management systems. Each system generates its audit logs, which are stored in separate repositories. Different teams analyze and review them independently, with each team reporting the findings to the respective departmental heads. For instance, the engineering team reviews and analyzes logs related to the design systems and reports to the lead engineer, while the operations team focuses on the manufacturing system logs. When interviewing personnel responsible for audit record review, analysis, and reporting, they inform you that this is deliberately set up to ensure departmental independence and granular risk identification.

  Based on the CMMC practice AU.L2-3.3.5 - Audit Correlation, what is the likely issue you would identify with the contractor's current approach?

  A. Lack of defined processes for audit record review, analysis, and reporting
  B. The audit review, analysis, and reporting processes are not correlated across systems
  C. Absence of automated mechanisms for analyzing and correlating audit records
  D. Failure to retain audit logs for an adequate duration
  B. The audit review, analysis, and reporting processes are not correlated across systems

• Question 404:

  AC.L2-3.1.6: Non-Privileged Account Use is being assessed.

  Which procedure BEST meets all of the standards for non-privileged account use?

  A. All employees are given a non-privileged user account. System Administrators are given a separate administrator account. System Administrators use their administrator account for security tasks.
  B. All employees are given a non-privileged user account. System Administrators are given a separate administrator account. System Administrators use their non-privileged account for security tasks.
  C. All non-IT employees are given a non-privileged user account. System Administrators are given a separate administrator account. System Administrators use their administrator account for all tasks.
  D. All non-IT employees are given a non-privileged user account. System Administrators are given only an administrator account. System Administrators use their administrator account for all tasks.
  B. All employees are given a non-privileged user account. System Administrators are given a separate administrator account. System Administrators use their non-privileged account for security tasks.

  ---

  Explanation

  AC.L2-3.1.6 requires that non-privileged accounts are used for normal tasks and privileged accounts are only used when necessary for privileged functions.

  Extract:

  "Require that users employ the least privilege principle by using non-privileged accounts for general tasks.

  Privileged accounts must only be used when elevated privileges are required."

  Thus, the correct procedure is:

  All employees have non-privileged accounts.

  Admins also have separate privileged accounts.

  Admins perform normal duties with their non-privileged accounts, using privileged accounts only when required.

  References:

  CMMC Assessment Guide - Level 2, AC.L2-3.1.6.

• Question 405:

  While conducting a CMMC Level 2 Assessment for a small waveguide manufacturer, the client provides a copy of their CMMC Level 1 Self-Assessment that their senior official has recently approved and uploaded to the Supplier Performance Risk System (SPRS).

  What type of information may be covered within the Level 1 Self-Assessment that is OUTSIDE the scope of a Level 2 assessment?

  A. CUI in paper format
  B. FCI within the CUI production enclave
  C. FCI data within the description in the contractor self-assessment
  D. Sensitive Compartmented Information (SCI) shredded by an approved vendor
  C. FCI data within the description in the contractor self-assessment

  ---

  Explanation

  CMMC Levels and Scope: Level 1: Protects Federal Contract Information (FCI) under FAR 52.204-21 (17 basic safeguarding requirements).

  Level 2: Protects Controlled Unclassified Information (CUI) under NIST SP 800-171 (110 practices).

  Why Option C is Correct: The Level 1 self-assessment covers FCI-related practices. Since Level 2 focuses exclusively on CUI environments, FCI-only requirements from the Level 1 self-assessment fall outside the scope of the Level 2 assessment.

  Why Other Options Are Insufficient:

  Option A (CUI in paper): Still in scope at Level 2 (CUI applies to both digital and physical formats).

  Option B (FCI within CUI enclave): If FCI is processed within the enclave, it is covered by Level 2.

  Option D (SCI): Classified information is entirely out of scope of CMMC; however, it is not relevant to Level 1 self-assessment either, making C the more precise choice.

  References (CCA Official Sources):

  DoD CMMC Model v2.0 - Scope Differences between Level 1 (FCI) and Level 2 (CUI) NIST SP 800-171 Rev. 2 - Focus on CUI FAR 52.204-21 - FCI Safeguarding Requirements (Level 1 baseline)

• Question 406:

  When preparing for an assessment, the assessor determines that the client's proprietary data resides within an enclave. However, the assessor is unable to review policies containing proprietary data onsite and plans to have the policies copied on removable media by the client's IT staff, whom they are scheduled to interview.

  What should the assessor consider as part of their planning?

  A. No proprietary data can leave the client's environment under any circumstances.
  B. The assessor can transmit data outside the client's environment if the client's IT support staff grants access.
  C. No proprietary data can leave the client's environment without the express written consent of the OSC POC.
  D. No proprietary data can leave the client's environment without the express written consent of the OSC Assessment Official.
  D. No proprietary data can leave the client's environment without the express written consent of the OSC Assessment Official.

  ---

  Explanation

  Assessor conduct is governed by the CMMC Code of Professional Conduct. Proprietary or sensitive data from the OSC environment cannot leave without express written consent from the OSC's Assessment Official (AO). The AO is the authorized point of control for assessment-related data. This protects client confidentiality and maintains ethical handling of sensitive information.

  Exact Extracts:

  CMMC Assessor Code of Professional Conduct: "No proprietary or sensitive information may be removed from an OSC environment without the express written consent of the OSC's designated Assessment Official." "Assessors are bound to protect confidentiality and may not transmit data outside of agreed assessment channels without written authorization."

  Why the other options are not correct:

  Option A: Too absolute - proprietary data can leave if AO provides written consent.

  Option B: IT staff cannot authorize release of proprietary data.

  Option C: POC is not the authority for data release - only the Assessment Official is.

• Question 407:

  During the Planning phase, the C3PAO and Lead Assessor will collect information from the OSC to provide a Rough Order of Magnitude (ROM). This enables the Assessor to approximate the duration, schedule, and cost of the Assessment.

  To determine the Rough Order of Magnitude (ROM), the Lead Assessor can use the following inputs, EXCEPT?

  A. The OSC's location and number of facilities.
  B. Education levels of the Assessment Team.
  C. The size and complexity of the OSC.
  D. The OSC's readiness.
  B. Education levels of the Assessment Team.

• Question 408:

  When interviewing a contractor's CISO, they inform you that they have documented procedures addressing security assessment planning in their security assessment and authorization policy. The policy indicates that the contractor undergoes regular security audits and penetration testing to assess the posture of its security controls every ten months. The policy also states that after every four months, the contractor tests its incident response plan and regularly updates its monitoring tools. Impressed by the contractor's policy implementation, you decide to chat with various personnel involved in security

  functionalities. You realize that although it is documented in the policy, the contractor has not audited their security systems in over two years.

  How many points would you score the contractor's implementation of the practice CA.L2-3.12.1 - Security Control Assessment?

  A. -5
  B. -3
  C. -1
  D. 5
  A. -5

• Question 409:

  In your assessment of an OSC's information systems, you realize that the OSC has been having issues determining what is and isn't CUI. One of the employees asks for your help identifying CUI so that they can take measures to protect it. They also request that you recommend a resource where they can understand the national CUI policy.

  Which of the following is the BEST resource they should visit to understand what CUI is and the national CUI policy?

  A. 48 CFR 52.204-21 and NIST SP 800-171
  B. DFARS 252.204-7012 and ISOO CUI Registry
  C. 32 CFR Part 2002 and ISOO CUI Registry
  D. 22 CFR Part 120-130
  C. 32 CFR Part 2002 and ISOO CUI Registry

• Question 410:

  A CCA is conducting an interview with an OSC system administrator who admits that a required practice is not implemented because "we don't have the budget for it this year." The CCA notes this in their findings.

  What principle of the CoPC does the CCA uphold by documenting this statement without offering advice?

  A. Confidentiality
  B. Professionalism
  C. Objectivity
  D. Information Integrity
  C. Objectivity