Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 451:

  When validating an OSC's proposed CMMC assessment scope, the Assessment Team finds that the OSC has properly categorized its assets. The OSC has contracted an External Service Provider (ESP) for various cybersecurity functions. The ESP has deployed FortiSIEM and Splunk for real-time security monitoring, threat intelligence, application monitoring, log management, and reporting. They also deployed Microsoft Intune and configured app protection policies blocking proscribed apps and those suspected of data exfiltration.

  What type of asset is the ESP?

  A. Contractor Risk Managed Asset (CRMA)
  B. Security Protection Asset (SPA)
  C. Out-of-scope asset
  D. CUI Asset
  B. Security Protection Asset (SPA)

• Question 452:

  A C3PAO Assessment Team is conducting a CMMC Level 2 assessment. During the assessment, the OSC provides evidence that a practice is partially implemented, with plans to complete it within a month.

  The practice is not eligible for the Limited Practice Deficiency Correction Program.

  How should the Lead Assessor score this practice?

  A. Score it as "MET" since the OSC has a plan to complete it soon.
  B. Score it as "NOT MET" since it is not fully implemented and is ineligible for deficiency correction.
  C. Score it as "PARTIALLY MET" and include it in a POA&M.
  D. Defer scoring until the OSC completes the implementation.
  B. Score it as "NOT MET" since it is not fully implemented and is ineligible for deficiency correction.

• Question 453:

  A CCA who works for a C3PAO doubles as a penetration tester. When conducting a CMMC assessment for an OSC, he realizes their cybersecurity practices are lacking. Recognizing potential vulnerabilities in their systems, the CCA approaches the OSC's cyber team and offers his penetration testing services.

  Which CoPC guiding principle or practice has the CCA failed to live up to?

  A. Assurance
  B. Conflict of Interest
  C. Professionalism
  D. Confidentiality
  C. Professionalism

• Question 454:

  A leading technology solutions provider that works with various government agencies and commercial clients has implemented a dedicated CUI enclave within its network infrastructure to ensure the secure handling of CUI. As a Certified CMMC Assessor, you are tasked with assessing the scope of the solutions provider's CMMC requirements.

  Which statement best describes the appropriate approach for scoping the assessment within the context of the CUI enclave?

  A. The assessment scope is limited to the physical boundaries of the solutions provider's CUI security domain, excluding any logical or network-based interactions.
  B. Regardless of the CUI security domain implementation, the entire solutions provider's network and all system components must be assessed.
  C. The assessment scope should include the solutions provider's CUI enclave and any supporting organization's components or systems that interact with or provide services to the CUI security domain.
  D. Only the solutions provider's CUI security domain needs to be assessed, as it is the designated system component for handling CUI data.
  C. The assessment scope should include the solutions provider's CUI enclave and any supporting organization's components or systems that interact with or provide services to the CUI security domain.

• Question 455:

  The Lead Assessor is conducting an assessment for an OSC. The Lead Assessor has finished collecting and examining evidence from the assessment.

  Based on this information, what is the NEXT logical step?

  A. Develop an assessment plan.
  B. Deliver recommended assessment results.
  C. Generate final recommended assessment results.
  D. Determine and record initial practice scores.
  D. Determine and record initial practice scores.

  ---

  Explanation

  The CMMC Assessment Process (CAP) defines the logical order: After collecting and examining evidence, the next step is to determine and record initial practice scores (MET, NOT MET, or NA).

  Only after practice scoring is completed are findings validated and aggregated into final recommended results.

  Extract:

  "Following evidence collection and review, assessors determine and record the practice status (MET/NOT MET/NA) before compiling results into final recommendations."

• Question 456:

  You are assessing an organization's implementation of the System and Information Integrity (SI) practices.

  During your assessment, you find that the organization has subscribed to security alert and advisory services from reputable sources, such as US- CERT and relevant industry-specific organizations. In interviews with their network and system administrators, you learn that they have deployed an intrusion detection system (IDS) to monitor network traffic for known threats and suspicious activities. They also have a Security Information and Event Management (SIEM) system in place to aggregate and analyze logs from various sources for potential security incidents. Additionally, the network administrator informs you that they have established a Security Operations Center (SOC) to monitor and analyze activity on networks, servers, databases, applications, and other systems. However, you notice that while the organization receives these alerts and advisories, there is no documented process or assigned personnel

  responsible for reviewing and acting upon them.

  After reviewing the organization's implementation, which of the following would be the most appropriate

  next step for the assessor to validate compliance with CMMC practice SI.L2-3.14.3 - Security Alerts&;

  Advisories?

  A. Test the organization's processes for defining, receiving, and disseminating security alerts and advisories
  B. Examine the organization's system and information integrity policies and procedures
  C. Review system audit logs and records for evidence of actions taken in response to security alerts and advisories
  D. Interview the personnel responsible for the Security Operations Center (SOC) to determine whether they take actions in response to security alerts and advisories
  D. Interview the personnel responsible for the Security Operations Center (SOC) to determine whether they take actions in response to security alerts and advisories

• Question 457:

  When validating an OSC's proposed CMMC assessment scope, the Assessment Team finds that the OSC has properly categorized its assets. The OSC has contracted an External Service Provider (ESP) for various cybersecurity functions. The ESP has deployed FortiSIEM and Splunk for real-time security monitoring, threat intelligence, application monitoring, log management, and reporting. They also deployed Microsoft Intune and configured app protection policies blocking proscribed apps and those suspected of data exfiltration.

  How should you handle the ESP during the CMMC assessment?

  A. Assess against CMMC practices.
  B. Assess them against CA.L2-3.12.4 - System Security Plan only.
  C. Review the SSP per practice CA.L2-3.12.4 - System Security Plan.
  D. They are out of scope; there is no need to assess them against CMMC practices.
  A. Assess against CMMC practices.

• Question 458:

  A Defense Contractor is preparing for their upcoming CMMC Level 2 assessment. One of the key controls they need to address is CMMC practice MP.L2-3.8.5 - Media Accountability, which deals with maintaining accountability for media containing CUI during transport outside of controlled areas. The organization regularly needs to transport physical media, such as hard drives and backup tapes, between their primary data center and an off-site storage facility. In the past, they have simply used standard packaging and commercial shipping services to move this media.

  Which of the following is NOT an assessment method for MP.L2-3.8.5 - Media Accountability?

  A. Testing mechanisms supporting or implementing media storage and media protection
  B. Examining designated controlled areas
  C. Interviewing organizational processes for storing media
  D. Examining procedures addressing media storage and access control policy
  C. Interviewing organizational processes for storing media

• Question 459:

  CMMC practice PS.L2-3.9.1 - Screen Individuals requires individuals to be screened before authorizing access to organizational systems containing CUI. However, in the assessment you are currently conducting, there is no physical evidence confirming the completion of personnel screens, such as background checks, only affirmations derived from an interview session. In an interview with the HR

  Manager, they informed you that before an individual is hired, they submit their information through a service that performs criminal and financial checks.

  How would you score the OSC's implementation of CMMC practice PS.L2-3.9.1 - Screen Individuals, objective [a]?

  A. More information is needed
  B. Not Met
  C. Not Applicable
  D. Met
  A. More information is needed

• Question 460:

  A C3PAO Assessment Team has completed assessing an OSC's implementation of the CMMC practices.

  They are now in the process of archiving the assessment artifacts as per the CAP. However, the OSC informed the Assessment Team that they could not take the artifacts offsite even after completing the assessment. The Assessment Team is concerned that the OSC may change the assessment artifacts, compromising their integrity.

  What should the Assessment Team recommend that the OSC do to protect the confidentiality and integrity of the Assessment Artifacts?

  A. Hash the assessment artifacts to create unique digital fingerprints for record-keeping purposes.
  B. Temporarily copy the artifacts to secure portable storage devices for offsite review and return them afterwards.
  C. Request the OSC to provide redacted versions of the artifacts for offsite review.
  D. Take photographs of the artifacts using their personal devices for later reference.
  A. Hash the assessment artifacts to create unique digital fingerprints for record-keeping purposes.