Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 41:

  An OSC is planning a CMMC Level 2 assessment that your C3PAO will conduct. In Phase 1.6.1 - Access and Verify Evidence, as the Lead Assessor, you are verifying the existence and accessibility of the evidence provided by the OSC. While reviewing the list of evidence mapped against the CMMC practices, you discover that the OSC cannot locate several critical system security policies for key IT systems supporting their DoD contracts. These missing policies are essential for demonstrating compliance with various CMMC practices related to access control, incident response, and system maintenance.

  According to the CMMC Assessment Process (CAP), which of the following is not permitted for the Lead Assessor to do during the evidence verification stage?

  A. Review the content of the evidence to identify potential weaknesses.
  B. Ensure that no proprietary data is included in the evidence for review.
  C. Verify that the evidence exists and is accessible.
  D. Offer advice on how the OSC can improve the sufficiency of their evidence.
  D. Offer advice on how the OSC can improve the sufficiency of their evidence.

• Question 42:

  A Defense Contractor is preparing for their upcoming CMMC Level 2 assessment. One of the key controls they need to address is CMMC practice MP.L2-3.8.5 - Media Accountability, which deals with maintaining accountability for media containing CUI during transport outside of controlled areas. The organization regularly needs to transport physical media, such as hard drives and backup tapes, between their primary data center and an off-site storage facility. In the past, they have simply used standard packaging and commercial shipping services to move this media.

  Which of the following is NOT an assessment method for MP.L2-3.8.5 - Media Accountability?

  A. Testing mechanisms supporting or implementing media storage and media protection
  B. Examining designated controlled areas
  C. Interviewing organizational processes for storing media
  D. Examining procedures addressing media storage and access control policy
  C. Interviewing organizational processes for storing media

• Question 43:

  You decide to interview the IT security team to understand if and how a contractor has implemented audit failure alerting. You learn they have deployed AlienVault OSSIM, a feature-rich security information and event management (SIEM) tool. The SIEM tool has been configured to send automatic alerts to system and network administrators if an event affects the audit logging process. Alerts are generated for the defined events that lead to failure in audit logging and can be found in the notification section of the SIEM portal. However, the alerts are sent to the specified personnel 24 hours after the occurrence of an event.

  As an assessor evaluating the implementation of AU.L2-3.3.4 - Audit Failure Alerting, which of the following would be a key consideration regarding the evidence provided by the contractor?

  A. Ensuring the defined alert notification methods (e.g., email, SMS) are secure and encrypted
  B. Verifying that the types of audit logging failures defined cover a comprehensive range of potential scenarios
  C. Determining if the documented personnel roles for alert notification align with the organization's hierarchy
  D. Checking if the alert notification process integrates with third-party monitoring services
  B. Verifying that the types of audit logging failures defined cover a comprehensive range of potential scenarios

• Question 44:

  While examining the customer responsibility matrix submitted by the OSC for one of its Cloud Service Providers (CSPs), the Assessor notes that the matrix was substantially completed by the OSC's RPO. In fact, there is a statement from the RPO that the CSP has met the requirements for FedRAMP MODERATE.

  In order to accept that this CSP is qualified to perform some of the practices on behalf of the OSC, what should occur?

  A. The CSP must have its service certified for FedRAMP by a certified C3PAO.
  B. The OSC should provide the contract documents for the CSP specifying that it must meet NIST SP 800-171 practices.
  C. The OSC must be able to demonstrate that the CSP is providing its services in a manner that complies with CMMC Level 2.
  D. There must be other evidence that an independent firm has confirmed the security controls meeting FedRAMP MODERATE are in place.
  C. The OSC must be able to demonstrate that the CSP is providing its services in a manner that complies with CMMC Level 2.

  ---

  Explanation

  The OSC remains responsible for ensuring that any External Service Provider (ESP) such as a CSP supports compliance with CMMC. FedRAMP authorization is evidence, but the OSC must still demonstrate that the CSP's services are being used in a manner that complies with CMMC Level 2 requirements.

  Extract:

  "The OSC is responsible for demonstrating that services provided by external providers are implemented and operated in a manner that complies with CMMC requirements for the OSC's environment." Therefore, the OSC must provide proof of compliance in their environment, not simply rely on FedRAMP documentation.

• Question 45:

  After a security audit, a contractor documents specific vulnerabilities and deficiencies in an audit report.

  After examining its POA&M, you realize it has a clearly defined policy on addressing these deficiencies and by when. However, after interviewing the contractor's security and compliance team, you learn that while an audit is regularly conducted, the remediating measures are not always taken, and when taken, they are not always practical. The security and compliance team informs you they have tried reaching the system administrator to explain the repercussions of this without success.

  What assessment objective has the contractor failed to implement from CMMC practice CA.L2-3.12.2 - Plan of Action?

  A. The contractor has implemented all the assessment objectives in CA.L2-3.12.2 - Plan of Action
  B. Develop a change management plan that describes how to implement the remediation actions
  C. Implement a plan of action to correct the identified deficiencies and reduce or eliminate identified vulnerabilities that are ineffective
  D. Identify the vulnerabilities and deficiencies that the plan of action will address
  C. Implement a plan of action to correct the identified deficiencies and reduce or eliminate identified vulnerabilities that are ineffective

• Question 46:

  When assessing an OSC's implementation of the System and Information Integrity (SI) practices, you examine their system and information integrity policy. You find that they have documented procedures addressing system monitoring tools and techniques, along with a monitoring strategy. The OSC has implemented a user behavior analytics tool to detect abnormal behavior anddeviations from normal patterns. To ensure that only authorized users access the system, the OSC uses robust access controls and regularly audits security and system logs for unusual activities. Interviewing the network administration team, you learn they use a network monitoring tool to track inbound and outbound network traffic and identify any distinctive patterns that may suggest unauthorized use. You also learn that they use an IDS to identify suspicious activities, which are aggregated and analyzed using a state-of-the-art SIEM. The scenario mentions that the OSC uses a network monitoring tool to track inbound and outbound traffic and identify unusual patterns. However, it does not provide details on the tool's specific techniques or methods.

  Which of the following techniques would be most relevant for the assessor to inquire about during the assessment?

  A. Anomaly-based detection techniques
  B. Signature-based detection techniques
  C. Both signature-based and anomaly-based detection techniques
  D. Deep packet inspection techniques
  C. Both signature-based and anomaly-based detection techniques

• Question 47:

  An OSC is undergoing CMMC Assessment on an enterprise-wide basis. While walking to the conference room, the Assessor notices a printer repair technician in the hallway, unescorted, repairing a printer marked "Authorized for CUI printing."

  What is the NEXT step the Lead Assessor should take regarding PE.L2-3.10.3: Escort Visitors?

  A. Make a note and score the practice as MET
  B. Ask the printer technician to leave immediately
  C. Make a note and score the practice as NOT MET
  D. Ask the OSC if the printer technician has authorized access
  D. Ask the OSC if the printer technician has authorized access

  ---

  Explanation

  The assessor must first confirm facts with the OSC before making a determination. It is possible the technician has been granted temporary authorized access, in which case the situation may not be a violation. Therefore, the correct next step is to ask the OSC about the technician's authorization.

  Exact Extracts:

  PE.L2-3.10.3: "Escort visitors and monitor visitor activity."

  Assessment Guide: "Assessors should confirm with the OSC whether individuals observed are classified as visitors or authorized personnel before determining compliance." "Findings must be validated with OSC-provided evidence or clarification."

  Why other options are not correct:

  Option A: Cannot mark as MET without verifying the technician's status.

  Option B: Inappropriate - assessors do not direct OSC personnel or vendors.

  Option C: Cannot mark as NOT MET without first confirming authorization.

• Question 48:

  You are a Lead Assessor, and an OSC has engaged your C3PAO firm to conduct a CMMC assessment.

  As the Lead Assessor, you are responsible for identifying, documenting, and communicating any potential risks that could impact the successful completion of the planned assessment. You need to evaluate various risk categories and develop mitigation plans to ensure a smooth assessment process.

  If a member of the Assessment Team is at risk of being delayed and is unable to start the assessment on time, which of the following would be an appropriate mitigation plan?

  A. Proceed with the assessment without the delayed team member
  B. Request additional resources from the OSC to compensate for the delayed team member
  C. Reschedule the assessment for a later date
  D. Identify an alternate resource to shadow the Assessment Team member and potentially act as a successor
  D. Identify an alternate resource to shadow the Assessment Team member and potentially act as a successor

• Question 49:

  A CCA was part of an Assessment Team tasked with conducting a CMMC assessment for an OSC. Happy to have been part of the team that completed the assessment, the CCA posted the OSC's assessment results on their Twitter/X account.

  Which CMMC Code of Professional Conduct (CoPC) principle has the CCA violated?

  A. Availability
  B. Proper Use of Methods
  C. Confidentiality
  D. Objectivity
  C. Confidentiality

• Question 50:

  During a CMMC assessment, the OSC provides a policy document that is signed by a manager who left the company six months ago. The OSC insists the policy is still enforced, and staff interviews confirm its use.

  How should the Lead Assessor proceed?

  A. Accept the policy as valid evidence since it is still enforced.
  B. Document the outdated signature as an evidence gap and assess the policy's implementation based on interviews and other evidence.
  C. Reject the policy due to the outdated signature and score the practice as "NOT MET."
  D. Request the OSC to obtain a new signature from current management before proceeding.
  B. Document the outdated signature as an evidence gap and assess the policy's implementation based on interviews and other evidence.