Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 501:

  You are the Lead Assessor conducting a CMMC assessment for an OSC. During the initial stages ofthe assessment, the OSC provided a comprehensive list of evidence sources, including various documents, policies, and procedures. However, as the assessment progresses, you notice that the OSC has started to rely more heavily on demonstrations and live system tests to showcase their compliance with certain CMMC practices. While these demonstrations and tests provide valuable insights, they deviate from the originally planned approach of primarily relying on documented evidence. This change in the evidence collection approach could potentially impact the assessment timeline and the overall assessment plan.

  As the Lead Assessor, what should you do in response to this change in the evidence collection approach?

  A. Proceed with the assessment as planned, after all, the OSC is providing evidence.
  B. Document the change in the evidence collection approach by updating the Pre-Assessment Data Form and exporting the updated file to CMMC eMASS while continuing with the assessment as appropriate.
  C. Request the OSC to revert to the originally planned approach citing the agreed-to and planned approach documented in the Assessment Plan.
  D. Pause the assessment until a revised assessment plan can be developed to accommodate the increased reliance on demonstrations and live system tests.
  B. Document the change in the evidence collection approach by updating the Pre-Assessment Data Form and exporting the updated file to CMMC eMASS while continuing with the assessment as appropriate.

• Question 502:

  During your assessment of CA.L2-3.12.3 - Security Control Monitoring, the contractor's CISO informs you that they have established a continuous monitoring program to assess the effectiveness of their implemented security controls. When examining their security planning policy, you determine that they have a list of automated tools they use to track and report weekly changes in the security controls. The contractor has also established a feedback mechanism that helps them identify areas for improvement in their security controls. During discussions with employees, you understand that the contractor regularly invites resource persons to train them on the secure handling of information and identifying gaps in implemented security controls.

  Can the contractor place practice CA.L2-3.12.3 - Security Control Monitoring under a POA&M if it is unimplemented or not fully met?

  A. No, the practice cannot be placed on a POA&M
  B. Yes, for some aspects
  C. More information is required to make determination
  D. Yes, for all aspects
  A. No, the practice cannot be placed on a POA&M

• Question 503:

  An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1 - System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet.

  The following conditions hold true for CMMC practices ineligible for deficiency corrections EXCEPT?

  A. Practices that could lead to significant exploitation of the network or exfiltration of CUI.
  B. Practices that were not implemented by the OSC prior to the current CMMC Assessment.
  C. Practices listed on the OSC's Self-Assessment Practice Deficiency Tracker.
  D. Practices that involve minor updates to existing policies or procedures but have been in place for a period of time.
  D. Practices that involve minor updates to existing policies or procedures but have been in place for a period of time.

• Question 504:

  During a CMMC Level 2 assessment, the OSC's Assessment Official asks the Lead Assessor if they can exclude a small subsidiary from the assessment scope because it only handles a minimal amount of CUI.

  The subsidiary's systems are networked with the main OSC environment.

  What should the Lead Assessor do?

  A. Agree to exclude the subsidiary since it handles minimal CUI.
  B. Request the OSC to include the subsidiary in the scope due to its networked connection and CUI handling, and adjust the assessment accordingly.
  C. Proceed with the original scope and ignore the subsidiary's systems.
  D. Terminate the assessment until the OSC resolves the subsidiary's inclusion internally.
  B. Request the OSC to include the subsidiary in the scope due to its networked connection and CUI handling, and adjust the assessment accordingly.

• Question 505:

  The OSC has changed its manner of operations in the past year to isolate its manufacturing division (which handles CUI) from its managerial team (which does not). Upon review of the provided information, the Lead Assessor was unable to identify this isolation in the environment.

  Which step should the Assessor take NEXT to understand how the current documentation isolates the operational components?

  A. Review the network or topology diagrams
  B. Review the change tickets and inventory updates
  C. Review the SSP
  D. Review to confirm the baseline configurations exist
  A. Review the network or topology diagrams

  ---

  Explanation

  Applicable Requirement (CAP & Scoping): Assessors must use objective artifacts to validate system boundaries and scoping decisions. Network or topology diagrams are the most direct method to confirm logical and physical separation between environments handling CUI and those that do not.

  Why A is Correct: Network/topology diagrams provide a visual and technical representation of how isolation is achieved (e.g., VLANs, firewalls, segmentation). This is the primary evidence source for confirming separation.

  Why Other Options Are Insufficient:

  Option B: Change tickets/inventory show updates but not logical isolation.

  Option C: The SSP describes but does not demonstrate separation.

  Option D: Baseline configs show standard builds, not network isolation.

  References (CCA Official Sources):

  CMMC Assessment Process (CAP) - Scope Validation CMMC Assessment Guide - Level 2 - Evidence Types (network diagrams, topology)

• Question 506:

  The use of removable storage media remains a source of data breaches. The CMMC requires control of the use of removable media on system components. As a CCA, you can use different assessment methods to determine whether an OSC has met this requirement.

  What is the best assessment method to ascertain that MP.L2-3.8.7[a] has been met?

  A. Examining System Media Protection Policy
  B. Interviewing personnel with responsibilities for system media use
  C. Testing mechanisms that restrict or prohibit the use of removable media on systems or system components
  D. Examining System Design documentation
  C. Testing mechanisms that restrict or prohibit the use of removable media on systems or system components

• Question 507:

  The OSC's network consists of a single network switch that connects all devices. This includes the OSC's OT equipment, which processes CUI. The OT controller requires an unsupported operating system.

  What can the Lead Assessor BEST conclude about the overall compliance with MA.L2-3.7.1: Perform Maintenance?

  A. It is MET only if every asset that is not a Specialized Asset is maintained.
  B. It is MET only if the environments are demarcated on the baseline diagram.
  C. It is NOT MET because industrial equipment should not be processing CUI.
  D. It is NOT MET because the OSC has not managed the risk of a CUI system being outdated.
  D. It is NOT MET because the OSC has not managed the risk of a CUI system being outdated.

  ---

  Explanation

  MA.L2-3.7.1 (Perform Maintenance) requires that maintenance activities and risks associated with outdated or unsupported systems be managed. Unsupported systems create a security risk if not mitigated, particularly when they process CUI.

  Extract:

  "Maintenance must be performed and documented to ensure continued secure operation. When systems cannot be updated or patched due to technical limitations, the OSC must implement and document risk mitigation strategies."

  Because the OSC has not demonstrated risk management for the outdated OT system, the practice is

  NOT MET.

  References:

  CMMC Assessment Guide - Level 2, MA.L2-3.7.1.

• Question 508:

  Understanding that changes are critical in any production environment, a DoD contractor has instituted measures to manage them. All software changes can only be implemented by defined individuals. These changes must have gone through a rigorous change approval process and must be implemented from a secure server located in the company's headquarters. The personnel affecting the changes access the server room using access cards and an iris scan. To log into the server, they must enter their passwords to receive a one-time password (OTP), which must be keyed in within 2 minutes. After any changes are made, the chairperson of the contractor's Change Review Board and the CISO get a notification to approve the changes before they take effect.

  Based on the contractor's current implementation, how would you score their effort to address CM.L2-3.4.5

  - Access Restrictions for Change?

  A. Met (+1 point)
  B. Met (+5 points)
  C. Met (+3 points)
  D. Not Met (-5 points)
  B. Met (+5 points)

• Question 509:

  During an assessment, the OSC person being interviewed explains the process for escorting visitors. The individual states that while all visitors are escorted, occasionally a vendor may need access to a small room with only one door and limited standing room. In these cases, the escort sits outside the room and observes the vendor completing the work.

  Is this practice in line with the escort policy?

  A. No, the escort is not allowed to sit down
  B. No, the escort must always be in the same room
  C. Yes, since the visitor can only use a single entry
  D. Yes, so long as the visitor's actions can still be viewed by the escort
  D. Yes, so long as the visitor's actions can still be viewed by the escort

  ---

  Explanation

  Applicable Requirement: PE.L2-3.10.3 -"Control physical access to organizational systems, equipment, and operating environments."

  Why Option D is Correct: Escort requirements are met as long as the visitor's actions are continuously observed and controlled. The escort does not need to be physically inside the same room if direct observation is possible.

  Why Other Options Are Insufficient:

  Option A: Escort posture (sitting/standing) is irrelevant.

  Option B: Same-room presence is not required by CMMC/NIST SP 800-171.

  Option C: A single entry point helps, but observation is the requirement.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - PE.L2-3.10.3 CMMC Assessment Guide - Level 2 - Physical Escort Policy Guidance

• Question 510:

  An OSC is planning to have a C3PAO perform a CMMC Level 2 assessment. When validating the OSC's proposed assessment scope, you realize they use an ESP for various cybersecurity services.

  What action must you, as a CCA, take regarding the ESP?

  A. Confirm the ESP has a CMMC Level 2 or Level 3 certification.
  B. Accept the OSC's inclusion of the ESP in their assessment scope.
  C. Advise the OSC to choose another ESP.
  D. Request a self-assessment from the ESP.
  A. Confirm the ESP has a CMMC Level 2 or Level 3 certification.