Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 471:

  A representative of a CMMC Level 2 certified DoD contractor has reached out to you as a CCA for an explanation of FedRAMP equivalency. They want to use a Cloud Service Offering (CSO) from a renowned CSP, but in light of the DoD FedRAMP equivalency memo, they are reluctant. In your conversation, you learn that although the CSO has impressive features, the assessment by a FedRAMP 3PAO resulted in a Plan of Action and Milestones (POA&M) that the CSP is remedying.

  What is the main reason the contractor shouldn't use the CSP's services?

  A. The CSP has not closed out the POA&Ms
  B. The CSO is not DFARS 252.204-7019 compliant
  C. The CSO has not been given JAB P-ATO
  D. The CSO hasn't fully met (100%) FedRAMP Moderate or equivalent baselines
  D. The CSO hasn't fully met (100%) FedRAMP Moderate or equivalent baselines

• Question 472:

  As part of a C3PAO Assessment Team, you are reviewing an OSC's security practices and documentation. During your review, you notice that the OSC has presented the same evidence artifacts to support its implementation of several CMMC practices and objectives.

  Based on the scenario above and your understanding of the CMMC Assessment process, which of the following is true?

  A. The same evidence artifacts can be used for practices across multiple CMMC domains, but not for assessment objectives.
  B. Each CMMC domain or assessment objective requires a unique set of evidence artifacts.
  C. The same evidence artifacts can be used for practices across multiple CMMC domains or assessment objectives.
  D. A POA&M can be used in place of evidence.
  C. The same evidence artifacts can be used for practices across multiple CMMC domains or assessment objectives.

• Question 473:

  During scoping discussions with a Lead Assessor, the OSC mentions that there are several connected systems within the organization's network.

  How should the Lead Assessor consider connected systems in the scoping of the CMMC assessment?

  A. Connected systems are never in scope unless specifically requested by the OSC.
  B. Connected systems are only in scope if they directly transmit FCI and/or CUI.
  C. Only internally connected systems directly handling FCI and/or CUI are in scope.
  D. Connected systems would be considered in scope for the assessment if the systems could impact the security of the CUI (or FCI) environment or if they store, process, or transmit CUI (or FCI) within the organization's network.
  D. Connected systems would be considered in scope for the assessment if the systems could impact the security of the CUI (or FCI) environment or if they store, process, or transmit CUI (or FCI) within the organization's network.

• Question 474:

  An OSC has submitted an assessment scope that includes some CUI and security protection assets. As a Lead Assessor, you are validating the CMMC assessment scope in preparation for a CMMC assessment for the OSC.

  How should you handle CUI and Security Protection Assets during the actual CMMC assessment?

  A. Assess the assets against a subset of the 110 controls.
  B. Conduct limited spot checks.
  C. Review only in the OSC's SSP.
  D. Assess the assets against the 110 CMMC practices.
  D. Assess the assets against the 110 CMMC practices.

• Question 475:

  Part of effective CUI protection involves knowing which assets process, transmit, or store CUI. This understanding is crucial for defining CUI boundaries within an OSC's systems. To achieve this, an OSC can prepare a logical data flow diagram for their information systems.

  Which of the following questions does a logical data flow diagram not answer?

  A. How does the data recipient receive the data?
  B. How is the system implemented?
  C. What data is being transmitted?
  D. What system, process, or individual receives the data?
  B. How is the system implemented?

• Question 476:

  An OSC is presenting the CMMC Assessment to the C3PAO along with all supporting documentation. The supporting documents include drawings from a patent application that has not been filed with the patent office and are marked as attorney-client privileged.

  What document is recommended that the OSC and C3PAO sign?

  A. Formal contract
  B. Statement of Work
  C. Non-disclosure agreement
  D. Formal disclosure agreement
  C. Non-disclosure agreement

  ---

  Explanation

  The CMMC Assessment Process (CAP) requires that when sensitive or proprietary materials are exchanged during an assessment, the OSC and the C3PAO should establish confidentiality protections through a Non-Disclosure Agreement (NDA).

  Extract:

  "OSC and C3PAOs are expected to execute a Non-Disclosure Agreement (NDA) to protect sensitive information such as proprietary, attorney-client privileged, or pre-patent materials shared during the assessment process."

  Thus, the NDA is the correct document.

  References:

  CMMC Assessment Process (CAP), Confidentiality Provisions.

• Question 477:

  An OSC leases several servers and rack space in a FedRAMP MODERATE authorized colocation data center. Additional servers operate in a LAN room within the company's facility. Both facilities are within the

  OSC's assessment boundary.

  In order to assess the physical protection of the environment, the Assessor MUST physically examine the visitor and access controls in place in the:

  A. Data center
  B. OSC's facility
  C. OSC's facility and the data center
  D. OSC's facility and the data center's customer relationship management regarding physical security
  C. OSC's facility and the data center

  ---

  Explanation

  Both the OSC's on-premise LAN room and the leased colocation data center are in-scope because they contain systems that process, store, or transmit CUI. Assessors must physically examine visitor and access controls at both locations to confirm compliance with PE practices.

  Exact Extracts:

  PE.L2-3.10.1: "Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals." PE.L2-3.10.3: "Escort visitors and monitor visitor activity." CMMC Assessment Guide: "Assessors must validate physical protections at all in-scope facilities where CUI assets reside." CMMC Scoping Guide: "Physical protection applies to all facilities within the CMMC Assessment Scope, including colocation facilities."

  Why the other options are not correct:

  Option A/B: Reviewing only one facility is insufficient; both are in scope.

  Option D: Customer relationship management reviews are not substitutes for physical examination by assessors.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: PE practices (pp. 153-159).

  CMMC Scoping Guide - Level 2: Facility requirements.

• Question 478:

  Patrick's company was hired to conduct a CMMC Level 2 assessment for Alto Technologies, where his aunt Jane is the VP of Marketing. Patrick did not disclose his relationship to Jane to his employer because he wanted to work on the Assessment Team and did not think Jane was aware of his job.

  Which of the following was the most appropriate course of action for Patrick?

  A. Recuse himself without explanation.
  B. Do not disclose the relationship since Jane likely wasn't aware of what he did for work.
  C. Disclose the potential conflict of interest to his employer before being assigned to the assessment.
  D. Follow the specific conflict-of-interest policies at his company.
  C. Disclose the potential conflict of interest to his employer before being assigned to the assessment.

• Question 479:

  You are a CCA conducting a CMMC Level 2 assessment for an OSC. During the assessment, you discover that the OSC has implemented a practice using a temporary workaround due to a recent system failure. The workaround meets the practice's objectives, but it is not documented in their System Security Plan (SSP).

  How should you evaluate this evidence?

  A. Accept the workaround as sufficient evidence and score the practice as "MET" since it meets the objectives.
  B. Document the lack of SSP inclusion as an evidence gap and assess the practice based on the workaround's effectiveness.
  C. Score the practice as "NOT MET" due to the absence of documentation in the SSP.
  D. Request the OSC to update the SSP to include the workaround before continuing the assessment.
  B. Document the lack of SSP inclusion as an evidence gap and assess the practice based on the workaround's effectiveness.

• Question 480:

  You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery.

  How will proper separation of duties help the contractor meet the intent of AC.L2-3.1.4 - Separation of Duties?

  A. It allows the engineers to specialize in specific areas
  B. It reduces concentrated privileges and power and improves checks & balances. Errors and malicious actions are more likely to be caught. Risk is reduced without relying solely on one individual
  C. It reduces the overall cost of software development
  D. It simplifies the development process
  B. It reduces concentrated privileges and power and improves checks & balances. Errors and malicious actions are more likely to be caught. Risk is reduced without relying solely on one individual