Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 461:

  During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled assessment dates. The OSC is eager to proceed as planned and has expressed willingness to accommodate a smaller assessment team.

  If the OSC Assessment Official asks the C3PAO for advice on how to proceed, the Lead Assessor, on behalf of the C3PAO, should do which of the following?

  A. Provide sufficient advice and recommendations.
  B. Politely refuse to provide any advice or recommendations.
  C. Provide general advice but avoid specific recommendations that could be seen as implementation assistance.
  D. Offer limited advice, but only if the OSC agrees to proceed with the assessment as originally scheduled.
  B. Politely refuse to provide any advice or recommendations.

• Question 462:

  During a CMMC assessment, the Assessment Team observes that the OSC is not enforcing practice objective CM.L2-3.4.5[d] - physical access restrictions associated with changes to the system are enforced. Understanding the deficiency, the OSC has requested to track the practice in the Limited Practice Deficiency Correction program, as it is part of their on-premises work.

  As a CCA, what should you do with respect to the OSC's implementation of this practice?

  A. Agree with the OSC and track the practice under the Limited Practice Deficiency Correction program.
  B. Report the OSC to Cyber AB.
  C. Mark it as `NOT MET'.
  D. Score the practice as `MET' since only one objective is not fulfilled.
  C. Mark it as `NOT MET'.

• Question 463:

  A company has multiple sites with employees at each site that must access the company's CUI network from their remote locations. The company has set up a single access point for all employees to access the network.

  What is the MOST significant factor in determining whether the security on this single access point is adequate?

  A. Remote access is secured and monitored.
  B. Physical access is monitored and controlled.
  C. The security requirements for CUI and FCI are documented.
  D. The remote personnel have notification procedures regarding connection issues.
  A. Remote access is secured and monitored.

  ---

  Explanation

  Applicable Requirement: AC.L2-3.1.12 and AC.L2-3.1.14 -"Monitor and control remote access sessions" and "Route remote access through managed access control points."

  Why A is Correct: For a single centralized access point, the most critical control is that remote access sessions are properly secured and monitored to prevent unauthorized access to CUI systems. This ensures both confidentiality and integrity of remote connections.

  Why Other Options Are Insufficient:

  Option B: Physical access controls protect on-site systems but do not address remote connection security.

  Option C: Documentation alone is not sufficient; actual monitoring and security enforcement are required.

  Option D: Notification procedures relate to incident handling, not adequacy of access point security.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - AC.L2-3.1.12, AC.L2-3.1.14 NIST SP 800-171A - Remote Access Assessment Objectives CMMC Assessment Guide - Level 2, Remote Access Guidance

• Question 464:

  A CCA is assessing the concept of least functionality in accordance with CM.L2-3.4.6: Least Functionality.

  Which method is the LEAST LIKELY to be useful as an assessment technique?

  A. Interview personnel with information security responsibilities.
  B. Interview personnel with application development responsibilities.
  C. Interview personnel who wrote the configuration management policy.
  D. Interview personnel with security configuration management responsibilities.
  C. Interview personnel who wrote the configuration management policy.

  ---

  Explanation

  To validate least functionality, the assessor must evaluate implementation (via security staff, admins, developers). Interviewing the policy author provides limited value since it does not confirm whether the policy is implemented in practice.

  Extract:

  "Assessors should confirm least functionality through interviews with individuals responsible for system configuration, security, and implementation. Policy documentation authors alone are not sufficient evidence." Thus, interviewing the policy writer is least useful.

• Question 465:

  As a CCA, you are part of a team conducting a CMMC assessment of an OSC. The OSC provides you with evidence of the implementation of CMMC practices, including a proprietary compression algorithm.

  While chatting and drinking with your buddies at a bar, you observe another CCA who is also part of your team demonstrating how to use the compression algorithm. This CCA happens to be the Tech Lead of a renowned IT company.

  What guiding principle of the CMMC Code of Professional Conduct has the other CCA violated?

  A. Confidentiality
  B. Information Integrity
  C. Availability
  D. Proper Use of Methods
  A. Confidentiality

• Question 466:

  You are the Lead Assessor for a CMMC Level 2 assessment. The OSC has provided a list of assets in scope, but during a site visit, you discover additional systems handling CUI that were not included in the initial scope.

  What should you do?

  A. Proceed with the assessment based on the original scope provided by the OSC.
  B. Request the OSC to revise the scope to include the additional systems and provide relevant evidence.
  C. Terminate the assessment due to the OSC's failure to accurately define the scope.
  D. Include the additional systems in the assessment without informing the OSC.
  B. Request the OSC to revise the scope to include the additional systems and provide relevant evidence.

• Question 467:

  A Lead Assessor and the OSC have been reviewing the scope. In preparing the final assessment scope, they disagree on some areas. After several days of attempting various solutions, they cannot find common ground.

  What should the CCA recommend to the C3PAO?

  A. The C3PAO formally writes to the OSC to start CMMC scoping afresh.
  B. Halt the assessment until the assessment scope is verified.
  C. The assessment continues as they address the areas of contention.
  D. Inform the C3PAO that the OSC has failed the assessment.
  B. Halt the assessment until the assessment scope is verified.

• Question 468:

  The assessor begins the assessment by meeting with the client's stakeholders and learns that multiple subsidiaries exist. In order to perform a complete assessment, the assessor must review documents from multiple entities as multiple, corresponding Commercial and Government Entity (CAGE) codes were provided.

  Which of the following entities may receive certification as a result of this?

  A. HQ organization
  B. HQ organization and Host unit
  C. Host unit and Supporting Organizations/Units
  D. HQ organization, Host unit, and Supporting Organizations/Units
  D. HQ organization, Host unit, and Supporting Organizations/Units

  ---

  Explanation

  Certification can only be granted to the legal entities that own the CAGE codes under assessment. If multiple CAGE codes are in play (HQ, host, and supporting units), and they are all included in scope, then all entities with corresponding CAGE codes that were assessed can be certified.

  Exact Extracts:

  CMMC Assessment Guide: "The CMMC certificate is issued to the legal entity (as identified by the CAGE code(s)) that was assessed." "When multiple CAGE codes are presented, all in-scope entities must provide documentation and may be certified if assessed." "Certification applies to the OSC legal entity (or entities) within scope, including HQ, host, and supporting units, as applicable."

  Why other options are not correct:

  Option A/B/C: Limit scope to only HQ or subsets, but the requirement is that all entities with provided and in-scope CAGE codes are eligible.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: Certification applicability to CAGE codes and organizational entities (pp. 3-5).

• Question 469:

  During an assessment, an assessor is trying to determine if the organization provides protection from malicious code at appropriate locations within organizational information systems.

  The assessor has decided to use the Interview method to gather evidence. It is BEST to interview:

  A. System developers
  B. System or network administrators
  C. Personnel with audit and accountability responsibilities
  D. Personnel with security alert and advisory responsibilities
  B. System or network administrators

  ---

  Explanation

  Malicious code protection is typically implemented and managed by system or network administrators, who configure, deploy, and monitor anti-malware solutions. Interviews with these administrators provide direct evidence of control implementation.

  Exact Extracts:

  SI.L2-3.14.2: "Provide protection from malicious code at appropriate locations within organizational information systems." CMMC Assessment Guide: "Interviews should be conducted with administrators responsible for deployment and monitoring of malicious code protection." NIST SP 800-171A (SI.L2-3.14.2): "Interview system or network administrators to determine how malicious code protection is implemented."

  Why other options are not correct:

  Option A (developers): Developers do not typically manage system-wide malicious code protections.

  Option C (audit personnel): They review logs, not deploy/manage protections.

  Option D (security advisory staff): They track alerts but don't operate malicious code defenses.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: SI.L2-3.14.2 (pp. 142-144).

  NIST SP 800-171Option A: Assessment procedures for malicious code protection.

• Question 470:

  In validating the OSC's implementation of AC.L2-3.1.16: Wireless Access Authorization, the CCA observes various personal and non-enterprise devices connected to the OSC's Wi-Fi. Because organizations handle wireless access differently, the CCA must locate evidence showing who has ultimate authority over wireless access.

  Which authority is acceptable for authorizing wireless access?

  A. The CEO mandating IT to add their personal phone to the company Wi-Fi
  B. A written policy executed by the CEO listing the pre-authorization requirements for Wi-Fi connectivity
  C. The CEO emailing the company instructing everyone to put personal devices on the company Wi-Fi
  D. A detailed document from the head of IT with instructions on how to connect to the guest Wi-Fi network
  B. A written policy executed by the CEO listing the pre-authorization requirements for Wi-Fi connectivity

  ---

  Explanation

  CMMC Level 2 requires that wireless access be formally authorized based on management-approved policy and criteria. The Assessment Guide specifies that "management guidelines form the basis for the requirements that must be met prior to authorizing a wireless connection." Therefore, a written policy executed by the CEO, which defines pre-authorization requirements, constitutes proper evidence of authorization. Informal emails or IT connection instructions do not meet this requirement.

  Exact extracts:

  "Authorize wireless access prior to allowing such connections."

  "Assessment Objectives... Determine if: [a] wireless access points are identified; and [b] wireless access is authorized prior to allowing such connections." "Guidelines from management form the basis for the requirements that must be met prior to authorizing a wireless connection. These guidelines may include the following: - types of devices, such as corporate or privately owned equipment; - configuration requirements of the devices; and - authorization requirements before granting such connections." Assessment method -

  Examine: "Access control policy; procedures addressing wireless implementation and usage (including restrictions); wireless access authorizations..."

  Why the other options are unacceptable: Option A and C are ad-hoc instructions from the CEO, not a formal management policy establishing authorization criteria.

  Option D is an IT-authored instruction document, not a management-level authorization policy.

  References (CCA documents / Study Guide):

  CMMC Assessment Guide - Level 2, Version 2.13, AC.L2-3.1.16 "Wireless Access

  Authorization" (Assessment Objectives; Discussion; Further Discussion; Potential Assessment Methods and Objects).

  NIST SP 800-171 Rev. 2, 3.1.16 (mapped within the CMMC Level 2 Assessment Guide).