Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 481:

  You are the Lead Assessor for a CMMC assessment of an OSC that has previously obtained ISO 27001 certification for its information security management system. During the initial discussions, the OSC requests that you consider their ISO 27001 certification and grant them credit toward their CMMC certification. They believe there is a significant overlap between CMMC and ISO 27001.

  What should your response to the OSC be?

  A. Defer the decision on non-duplication credit until the DoD publishes official non-duplication policies.
  B. Verify the validity and authenticity of the OSC's ISO 27001 certification against the requirements outlined in the CMMC Assessment Process (CAP) before considering granting any non-duplication credit.
  C. Inform the OSC that alternative cybersecurity certifications like ISO 27001 do not automatically bestow any status or credit towards CMMC certification.
  D. Grant the OSC credit towards their CMMC certification based on their ISO 27001 certification, as both standards cover similar cybersecurity requirements.
  C. Inform the OSC that alternative cybersecurity certifications like ISO 27001 do not automatically bestow any status or credit towards CMMC certification.

• Question 482:

  A company is seeking Level 2 CMMC certification. During the Limited Practice Deficiency Correction Evaluation, the Lead Assessor is deciding whether the company can be moved to a POA&M Close-Out.

  What condition will result if a POA&M Close-Out option cannot be utilized?

  A. The assessment will be paused until the OSC can meet all practices.
  B. The Lead Assessor will ask the OSC to justify not meeting all the practices.
  C. The OSC will be granted a provisional status until it can meet all the practices.
  D. The Lead Assessor will not recommend the OSC for CMMC Level 2 certification.
  D. The Lead Assessor will not recommend the OSC for CMMC Level 2 certification.

  ---

  Explanation

  If the OSC cannot remediate deficiencies during the POA&M Close-Out process, the Lead Assessor must issue a recommendation of NOT MET, and the OSC will not be certified. CMMC requires all Level 2 practices to be MET (with limited exceptions under defined POA&M close-out rules).

  Exact Extracts:

  CMMC Assessment Guide: "If practices cannot be met within the POA&M Close-Out process, the Lead Assessor must not recommend certification." DoD policy: "CMMC Level 2 requires that all 110 practices be met. A failed POA&M Close-Out results in a final determination of NOT MET." "There is no provisional certification status in CMMC."

  Why the other options are not correct:

  Option A: Assessments are not paused indefinitely; unresolved deficiencies result in NOT MET.

  Option B: Justification alone does not satisfy requirements.

  Option C: Provisional status does not exist in CMMC.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: POA&M Close-Out procedures (pp. 14-16).

  DoD CMMC Program Documentation: Requirement for all practices to be MET for certification.

• Question 483:

  During a CMMC assessment, a CCA took home some documents from the OSC's facility without their knowledge. The documents contained confidential, proprietary information (jet engine designs). After a few days, the OSC realized the documents were missing. Upon realizing the mistake, the CCA returned the document and informed the Lead Assessor. One year later, the information appeared online. The OSC believes the CCA duplicated the information and kept a copy for themselves. Angered by the situation, the

  OSC sues the CCA for IP theft.

  Under the CoPC, what action should the CCA take?

  A. Plead guilty to receive a reduced fine.
  B. None; they should only defend themselves in court.
  C. Inform the Cyber AB within 30 days.
  D. Ask their C3PAO for legal assistance.
  C. Inform the Cyber AB within 30 days.

• Question 484:

  While conducting a CMMC Level 2 assessment at a 100-person manufacturing company, the assessor receives a yellow badge labeled "SPECIAL ACCESS." The assessor observes multiple badge types used by staff and visitors. The client explains that only three badge colors correspond to controlled access (with electronic access), while the rest are identifiers for seniority.

  How can the assessor BEST verify that the three colors are the only badges capable of accessing controlled areas for CUI-related activities?

  A. Interviewing CUI-cleared staff
  B. Reviewing standard operating procedures for badge issuance
  C. Reviewing retained electronic badge entry logs or audits thereof
  D. Borrowing a badge from another staff member and attempting to enter a controlled space
  C. Reviewing retained electronic badge entry logs or audits thereof

  ---

  Explanation

  Verification of physical access controls under PE.L2-3.10.3: Physical Access Control requires evidence from records, logs, and audit trails. Reviewing access logs provides direct confirmation of which badge types grant entry into controlled areas. SOPs or interviews may support the claim but are indirect; testing physical entry is not an approved method for CCAs.

  Exact extracts:

  "Assessment Methods - Examine: access control policy; physical access control system records; physical access audit logs." "Assessment Methods -

  Interview: staff may be interviewed, but interviews must be supported by documentary evidence." "Testing physical entry by assessors is not an authorized assessment method."

  Why the other options are incorrect:

  Option A/B: Interviews or SOP reviews may provide supporting context, but they do not prove operational badge restrictions.

  Option D: Assessors are prohibited from attempting physical bypass or entry tests.

  References:

  CMMC Assessment Guide - Level 2, PE.L2-3.10.3 "Physical Access Control."

• Question 485:

  While scoping the assessment, the assessor learns that the OSC uses various cloud-based solutions sporadically as part of its normal course of business. The OSC states that most business is conducted on-premises and that only a small amount of business uses the cloud. The OSC thinks the cloud is only used for system backups, but there are isolated exceptions.

  Are the data provided sufficient to determine that the OSC limits connection to external information systems?

  A. No, the OSC stated most of its business is on-premises.
  B. No, the OSC did not fully define the extent external connections are used.
  C. Yes, the OSC confirmed that external connections occur.
  D. Yes, the OSC confirmed that external connections occur for system backups.
  B. No, the OSC did not fully define the extent external connections are used.

  ---

  Explanation

  To scope connections to external systems, the OSC must fully define all external connections - not just general statements about "small use" or "backups." Incomplete or vague descriptions are not sufficient for scoping.

  Extract:

  "The OSC must identify and define the extent of all external connections that support processing, storage, or transmission of CUI to determine scope."

  Thus, the data provided are not sufficient, because the OSC has not fully defined external connections.

  References:

  CMMC Scoping Guidance - External Service Providers & External Connections.

• Question 486:

  During a CMMC Assessment, the assessor is determining if the Escort Visitors practice is MET.

  Personnel with which of the following responsibilities would be MOST appropriate to interview?

  A. Repair and facilities maintenance
  B. Local access control and information security
  C. Physical access control and information security
  D. Information technology management and operations
  C. Physical access control and information security

  ---

  Explanation

  The Escort Visitors practice falls under Physical and Environmental Protection (PE.L2-3.10.3), which requires organizations to escort visitors and monitor visitor activity. To validate this, the assessor should interview personnel responsible for physical access control (security guards, facility access managers) and information security (to confirm integration with CUI protection requirements).

  Exact Extracts:

  PE.L2-3.10.3: "Escort visitors and monitor visitor activity."

  Assessment Guide: "Interview personnel responsible for physical access control and security monitoring to confirm escort and visitor activity tracking."

  Assessment Objectives: Require evidence of visitor escorts, visitor logs, and monitoring practices.

  Why the other options are not correct:

  Option A (Repair/maintenance): Not responsible for escort procedures.

  Option B (Local access control only): Missing the information security link, which ensures visitors cannot access CUI assets.

  Option D (IT management): IT is not responsible for escorting visitors in physical spaces.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: PE.L2-3.10.3 (pp. 154-156).

  NIST SP 800-171Option A: Assessment procedures for visitor escort and monitoring.

• Question 487:

  When assessing a contractor's implementation of CMMC practices, you examine its System Security Plan (SSP) to identify its documented measures for audit reduction and reporting. They have a dedicated section in their SSP addressing the Audit and Accountability requirements. You proceed to interview their information security personnel, who informed you that the contractor has a dedicated Security Operations Center (SOC) and uses Splunk to reduce and report audit logs.

  What key features regarding the deployment of Splunk for AU.L2-3.3.6 - Reduction&; Reporting would you be interested in assessing?

  A. Ensure that Splunk is configured with appropriate RBAC to restrict access to log data, reports,and dashboards, ensuring that only authorized personnel can view or modify audit logs
  B. Ensure Splunk can retain audit records for a protracted amount of time
  C. Ensure that Splunk employs various filter rules for reducing audit logs to eliminate non-essential data and processes to analyze large volumes of log files or audit information, identifying anomalies and summarizing the data in a format more meaningful to analysts, thus generating customized reports
  D. Ensure Splunk can support compliance dashboards that provide real-time visibility into CMMC compliance status
  C. Ensure that Splunk employs various filter rules for reducing audit logs to eliminate non-essential data and processes to analyze large volumes of log files or audit information, identifying anomalies and summarizing the data in a format more meaningful to analysts, thus generating customized reports

• Question 488:

  After thoroughly evaluating the evidence gathered, the Assessment Team has generated their preliminary findings and recommendations for the OSC's target CMMC level. However, before finalizing the results, they need to validate their findings through a review process. Once the Preliminary Recommended Findings have been generated and validated, the Assessment Team needs to properly record them in the appropriate document or system.

  Where should the Assessment Team enter or record the preliminary recommended findings after generating and validating them?

  A. In the CMMC Assessment Results Template.
  B. Daily Checkpoint Log
  C. In the CMMC Assessment Findings Brief.
  D. CMMC Assessment In-Brief Template
  C. In the CMMC Assessment Findings Brief.

• Question 489:

  When a CCA is assessing a control through Examine, what MUST they meet?

  A. Documents utilized for review must be in their mailed form
  B. Documents must be policy, process, and procedure documents
  C. Training materials reviewed can be in-process as they are for educational purposes
  D. System-level, network, and data flow diagrams must be completed in draft format
  B. Documents must be policy, process, and procedure documents

  ---

  Explanation

  The Examine assessment method requires the assessor to review policies, processes, and procedures that are finalized and approved, not drafts or informal materials. This ensures the OSC has formally documented, management-approved artifacts supporting each practice. Drafts, in-process training materials, or incomplete diagrams do not satisfy the "Examine" method requirements.

  Exact extracts:

  "Examine: Review, inspect, and analyze assessment objects, such as policies, procedures, and system documentation." "Examine requires finalized artifacts; draft or incomplete materials do not constitute valid evidence."

  Why the other options are incorrect:

  Option A: "Mailed form" is irrelevant - only completeness and approval matter.

  Option C: Training materials are not substitutes for policy/process evidence.

  Option D: Draft diagrams do not satisfy final documentation requirements.

  References:

  CMMC Assessment Guide - Level 2, Assessment Methods.

  CMMC Assessor Guide, description of "Examine."

• Question 490:

  An OSC submits to the C3PAO Assessment Team for validation a CMMC assessment scope that includes an enclave. During validation, you learn that while CUI is stored on a single physical server, authorized employees can access it through virtual instances, thanks to VMware. You also determine that the OSC has deployed a DFARS-compliant firewall to protect network connections to the enclave and a VLAN to restrict communication between different portions of the network.

  Which method can the OSC be said to have used to secure its enclave?

  A. Physical separation
  B. Segmentation
  C. Decentralization
  D. Virtualization
  B. Segmentation