Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 421:

  During a CMMC assessment, the Assessment Team observes that the OSC is not enforcing practice objective CM.L2-3.4.5[d] - physical access restrictions associated with changes to the system are enforced. Understanding the deficiency, the OSC has requested to track the practice in the Limited Practice Deficiency Correction program, as it is part of their on-premises work.

  As a CCA, what should you do with respect to the OSC's implementation of this practice?

  A. Agree with the OSC and track the practice under the Limited Practice Deficiency Correction program.
  B. Report the OSC to Cyber AB.
  C. Mark it as `NOT MET'.
  D. Score the practice as `MET' since only one objective is not fulfilled.
  C. Mark it as `NOT MET'.

• Question 422:

  During a readiness assessment for CoolPlanes Inc., Liz, a CCA, discovers a folder of technical drawings and illustrations of the aircraft that CoolPlanes produces. Liz has a younger brother, J.D.,who loves airplanes. She thinks a large printed copy of one of the illustrations would make an excellent gift for J.D.'s birthday next month. She copies the drawing and sends it to be printed on a large canvas when she gets home.

  Which of the following principles of the CMMC Code of Professional Conduct did Liz most likely violate?

  A. Objectivity
  B. Professionalism
  C. Ethical Practices
  D. Confidentiality
  D. Confidentiality

• Question 423:

  During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team.

  If the decision is made to replan or reschedule the assessment, what is the C3PAO's required action, according to the CAP?

  A. Inform the OSC of the potential consequences of delaying the assessment.
  B. Offer consulting services to the OSC to address any cybersecurity gaps identified during planning.
  C. Submit a report to The Cyber AB outlining the reasons for the postponement.
  D. Agree with the OSC on a new assessment date and update the contract accordingly.
  D. Agree with the OSC on a new assessment date and update the contract accordingly.

• Question 424:

  You are a CCA working for a well-known C3PAO. You have been selected for an Assessment Team tasked with conducting a CMMC assessment on a C3PAO. While you are reviewing the presented evidence, one of the Assessment Team members informs you that they weren't trained for the job and that a friend helped them get the position.

  By employing non-credentialed individuals and assigning them assessment tasks, which requirement of the CoPC has the C3PAO violated?

  A. Integrity
  B. None; it is well within their rights to hire whomever they want.
  C. Confidentiality
  D. Professionalism
  D. Professionalism

• Question 425:

  The Assessment Team is meeting with the OSC team and experiences a situation where some members of the OSC team describe the IT infrastructure differently from others. In some discussions, one person identifies a series of ESPs, while another describes the infrastructure as on-premises.

  What should the Lead Assessor do to clarify the actual operational environment?

  A. Review the network diagrams
  B. Interview an authoritative OSC representative
  C. Review the system interconnection agreements
  D. Ask for the contact information of the identified ESPs
  A. Review the network diagrams

  ---

  Explanation

  Applicable Requirement (CAP - Scoping and Evidence Validation): When inconsistencies arise about the environment, assessors are required to examine objective artifacts that define boundaries, such as network diagrams and system architecture documentation.

  Why Option A is Correct: Network diagrams objectively show whether systems are hosted on-premises or involve ESPs (cloud, MSSPs, hosting providers). Reviewing them avoids ambiguity from inconsistent verbal descriptions.

  Why Other Options Are Insufficient:

  Option B: Interviewing another OSC representative may add to confusion rather than resolve it.

  Option C: Interconnection agreements confirm ESP relationships but do not resolve whether the OSC has on-prem or hybrid environments.

  Option D: Contacting ESPs directly is not part of the assessment process; OSC must provide evidence.

  References (CCA Official Sources):

  CMMC Assessment Process (CAP) v1.0 - Clarifying System Boundaries CMMC Assessment Guide - Level 2 - Evidence Types (network diagrams, architecture documentation)

• Question 426:

  You are a CCA working for a C3PAO that has entered into a contractual agreement to provide CMMC assessment services for an OSC. After validating the evidence, the C3PAO feels that thetask is beyond its capabilities and informs the OSC that it cannot continue with the assessment. The C3PAO cites "insufficient workforce" as the reason.

  What principle of the CMMC CoPC has the C3PAO broken?

  A. Adherence to Materials and Methods
  B. Information Integrity
  C. Professionalism
  D. Respect for Intellectual Property
  C. Professionalism

• Question 427:

  When examining an OSC's procedures for addressing transmission integrity and confidentiality, you interview their system administrator and learn that they use Secure File Transfer Protocol (SFTP) for secure CUI transmission. The OSC employs AES-256 to encrypt data before transmitting it. Any external connections to their internal servers or systems can only occur via a VPN. All emails containing CUI are encrypted and sent using Secure/Multipurpose Internet Mail Extensions (S/MIME). Internal CUI transfers are conducted over WPA3 secure Wi-Fi. All areas of the OSC's facilities where CUI is stored or processed are secured with biometrics. To prevent unauthorized CUI exfiltration or transfer, the OSC has deployed a data loss prevention solution. During employee interviews, you learn they receive regular awareness training on the importance of data encryption during transmission. Additionally, they conduct regular audits of transmission protocols and encryption measures to ensure their effectiveness.

  While AES-256 is a strong encryption algorithm, according to CMMC practice SC.L2-3.13.8 - Data in Transit, what additional factor is crucial for ensuring FIPS compliance with cryptographic modules used for protecting CUI in transit?

  A. The encryption algorithm must be open-source and publicly available for scrutiny
  B. The encryption software must be user-friendly and easy to implement for widespread adoption
  C. The cryptographic module used to implement AES-256 encryption must be validated against the FIPS 140-2 or FIPS 140-3 standards
  D. The encryption algorithm must be mathematically complex and resistant to brute-force attacks
  C. The cryptographic module used to implement AES-256 encryption must be validated against the FIPS 140-2 or FIPS 140-3 standards

• Question 428:

  An OSC seeking Level 2 certification has recently configured system auditing capabilities for all systems within the assessment scope. The audit logs are generated based on the required events and contain the correct content that the organization has defined.

  Which of the following BEST describes the next system auditing objective that the organization should define?

  A. Centralized audit log collection
  B. Integration of all system audit logs
  C. Review and update of logged events
  D. Retention requirements for audit records
  C. Review and update of logged events

  ---

  Explanation

  The next step after configuring audit logs and ensuring event content is correct is to periodically review and update the logged events to maintain alignment with evolving security requirements and risks.

  Extract from AU.L2-3.3.2 & AU.L2-3.3.7:

  "Organizations must review and update audit log events periodically to ensure they continue to support accountability and monitoring objectives."

  While centralized collection and retention are important, the next required objective per progression is review and update of logged events.

  References:

  CMMC Assessment Guide - Level 2, AU Domain.

• Question 429:

  John, a CCA, is attending a CMMC industry conference. During a networking event, he makes several inappropriate comments with sexual undertones to a female attendee.

  According to the CoPC's Lawful and Ethical Practices, how should John's behavior be evaluated?

  A. John's comments are acceptable as long as the female attendee does not report them to the Cyber AB.
  B. While unprofessional, John's comments do not violate the CMMC CoPC because they were made at a private industry event.
  C. John's behavior constitutes harassment and discrimination, which violate the CMMC CoPC.
  D. John's behavior is a violation only if he made the comments in connection with his CMMC assessment activities.
  C. John's behavior constitutes harassment and discrimination, which violate the CMMC CoPC.

• Question 430:

  While scoring the evidence for a particular CMMC practice, the Certified Assessor notes that one of the practice objectives is NOT MET, thereby scoring the entire practice as NOT MET. The OSC Assessment Official disagrees with the Certified Assessor's decision, and they both take the dispute to the Lead Assessor, who is unable to resolve the issue to the OSC's satisfaction.

  How will this dispute be settled?

  A. The Lead Assessor is the final arbiter of the dispute.
  B. The OSC can supply adequate proof to the Cyber-AB to overturn the decision.
  C. The Certified Assessor is certified and, as such, the decision will stand.
  D. The Lead Assessor will present the dispute to the C3PAO Official, who will make a ruling.
  D. The Lead Assessor will present the dispute to the C3PAO Official, who will make a ruling.

  ---

  Explanation

  The CMMC Assessment Process (CAP) specifies that when disputes cannot be resolved by the Lead Assessor, they must be elevated to the C3PAO Official, who has authority to make the final decision.

  Extract:

  "Unresolved disputes between the OSC and the Assessment Team must be elevated to the C3PAO Official for final resolution."

  Therefore, the C3PAO Official is the final arbiter in such disputes.

  References:

  CMMC Assessment Process (CAP), Dispute Resolution.