Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 511:

  You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC. You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC's compliance with the CMMC practices. During the evidence collection phase, you need to examine the OSC's policies and procedures related to the CMMC practice AC.L2-3.1.5

  - Least Privilege.

  Which of the following would be an appropriatesource of evidence for this practice?

  A. Testing the OSC's Role-Based Access Control (RBAC) and Privilege Access Management (PAM) tools.
  B. Observing the system administrators as they configure the systems.
  C. Examining the organization's system configuration documentation.
  D. Interviewing the system administrators about their daily activities.
  C. Examining the organization's system configuration documentation.

• Question 512:

  Different mechanisms can be used to protect information at rest.

  Which mechanism is MOST LIKELY to afford protection for information at rest?

  A. Patching
  B. File share
  C. Secure offline storage
  D. Cryptographic mechanisms
  D. Cryptographic mechanisms

  ---

  Explanation

  Applicable Requirement: SC.L2-3.13.16 -"Protect the confidentiality of CUI at rest."

  Why Option D is Correct: Cryptographic mechanisms (e.g., full-disk encryption, database encryption, file encryption) provide the strongest protection for information at rest by preventing unauthorized disclosure if systems or media are accessed.

  Why Other Options Are Insufficient:

  Option A (Patching): Protects against vulnerabilities, but not specific to data-at-rest confidentiality.

  Option B (File share): Provides a storage method, not protection.

  Option C (Secure offline storage): Helps physically, but not sufficient for digital confidentiality without encryption.

  References (CCA Official Sources):

  NIST SP 800-171 Rev. 2 - SC.L2-3.13.16 NIST SP 800-171A - SC.L2-3.13.16 Assessment Objectives

  CMMC Assessment Guide - Level 2, Data at Rest Protection

• Question 513:

  The Assessment Kickoff meeting is one of the most important sessions of any CMMC Assessment engagement.

  All the following are participants in this meeting, EXCEPT?

  A. Members of the OSC that will be providing evidence.
  B. The Lead Assessor.
  C. The OSC PoC.
  D. The CMMC Quality Assurance Professional (CQAP).
  D. The CMMC Quality Assurance Professional (CQAP).

• Question 514:

  The assessment team is discussing the pre-assessment scope with an OSC. The OSC would like to limit the scope of the security requirements in environments that contain FCI and/or CUI.

  In this case, the OSC should:

  A. Request a single CMMC certification for both activities
  B. Choose to conduct two separate CMMC certification activities
  C. Define an Assessment Scope for those assets that process, store, or transmit FCI
  D. Define a CMMC Self-Assessment Scope for only those assets that process, store, or transmit CUI
  B. Choose to conduct two separate CMMC certification activities

  ---

  Explanation

  If an OSC wishes to separate environments that process FCI from those that process CUI, they may pursue two separate CMMC certifications (Level 1 for FCI and Level 2 for CUI). A single certification cannot cover both environments unless all requirements for the higher level are met across the entire enterprise.

  Exact Extracts:

  CMMC Assessment Guide: "An OSC may choose to undergo multiple CMMC certification activities if they wish to limit scope between FCI and CUI environments." "Level 1 applies to safeguarding FCI, while Level 2 applies to CUI; separate certifications may be pursued if the OSC chooses to segregate these environments."

  Why the other options are not correct:

  Option A: A single certification would require all assets to meet Level 2 controls, which may not be the

  OSC's intent.

  Option C: Defining scope for FCI only aligns with Level 1, but this does not meet Level 2 certification requirements for CUI.

  Option D: A self-assessment scope only applies to Level 1 assessments, not Level 2 third-party certification.

• Question 515:

  You are assessing Conedge Ltd, a contractor that develops cryptographic algorithms for classified government networks. In reviewing their network architecture documents, you see they have implemented role-based access controls on their workstations using Active Directory group policies. Software developers are assigned to the "Dev_Roles" group which grants access to compile and test code modules.

  The "Admin_Roles" group with elevated privileges for system administration activities is restricted to the IT staff. However, when you examine the event logs on a developer workstation, you find evidence that a developer was able to enable debugging permissions to access protected kernel memory - a privileged function.

  Which of the following controls could have prevented the developer from executing this privileged function?

  A. Removing internet access
  B. Prohibiting inheritance of privileged permissions
  C. Enforcing dual authorization
  D. Implementing time of day restrictions
  B. Prohibiting inheritance of privileged permissions

• Question 516:

  David, a Certified CMMC Assessor (CCA), is conducting a CMMC assessment for a defense contractor.

  During the assessment, he observes the organization's CEO making several statements to the Assessment Team about the company's security practices that turn out to be false.

  How should David respond to the CEO's behavior according to the CMMC CoPC?

  A. Document the CEO's false statements in the assessment report and continue the assessment objectively.
  B. Ignore the CEO's false statements, as they are not directly related to the role of the CCA.
  C. Report the CEO's behavior to the Cyber AB, as it constitutes perjury.
  D. Confront the CEO directly and demand that they provide accurate information.
  A. Document the CEO's false statements in the assessment report and continue the assessment objectively.

• Question 517:

  During a social event after work, a CCA from your C3PAO team brags about providing "consulting advice" to an OSC they recently assessed for CMMC compliance. You know this directly violates the CoPC's restrictions on CCAs offering such services during an assessment.

  What is your ethical obligation in this situation?

  A. Publicly confront the CCA and remind them of the CoPC violation.
  B. Discreetly approach the CCA and offer to help them understand the CoPC guidelines.
  C. Immediately report the incident to the Cyber AB.
  D. Ignore the situation, as it doesn't involve you directly.
  B. Discreetly approach the CCA and offer to help them understand the CoPC guidelines.

• Question 518:

  You are performing an on-site assessment for a defense contractor that develops and manufactures embedded control systems for military drones. During your documentation review, you discover they have a System Security Plan (SSP) outlining a configuration management process. The SSP mentions the creation of baseline configurations for their drone control systems, but details are limited. You interview the IT manager responsible for configuration management. They explain they use a commercial configuration management tool to capture hardware and software configurations for the drone systems. They confirm that the baseline configurations include initial software versions but do not track firmware or network configurations. Additionally, while they update software versions through the tool, they do not have a documented process for reviewing and updating baseline configurations in response to security vulnerabilities or system modifications.

  Which of the following actions would be the MOST appropriate recommendation for the contractor to improve their compliance with CM.L2-3.4.1 - System Baselining?

  A. Developing and documenting a process for reviewing baseline configurations periodically and updating them to reflect changes in firmware versions, network topology, and security risks
  B. Instruct IT personnel to update baseline configurations whenever a new software version is deployed
  C. Replace their commercial configuration management tool with a different solution
  D. Increase the frequency of software updates for the drone control systems
  A. Developing and documenting a process for reviewing baseline configurations periodically and updating them to reflect changes in firmware versions, network topology, and security risks

• Question 519:

  You are part of an Assessment Team tasked with conducting a CMMC Assessment for an OSC. When assessing the contractor's implementation of SC.L2-3.13.6 - Network Communication by Exception, objectives [a] and [b], the OSC's system admin informs you that they use Fortinet Next-Generation Firewall (NGFW). Fortinet NGFWs are hardcoded to deny all traffic by default, and traffic is only allowed on an exception basis. While this is factual, the Lead Assessor asks you to test the NGFW to ascertain whether it meets the intent of Assessment Objectives in SC.L2-3.13.6 - Network Communication by Exception.

  What is the benefit of testing as an assessment method?

  A. Testing helps determine if CMMC practices are implemented and whether adequate resources were provided to the individuals performing the practices.
  B. Testing allows you to observe what has been done and what has not been done.
  C. Testing allows you to determine if the OSC has the intent to meet the Assessment Objectives.
  D. Testing provides insight into the OSC's handling of CMMC practices.
  B. Testing allows you to observe what has been done and what has not been done.

• Question 520:

  The OSC has contracted a C3PAO to perform a CMMC assessment. During Phase 1, the C3PAO discovers that the OSC does not have a Commercial and Government Entity (CAGE) code. The OSC's Assessment Official argues that they have never needed one before and asks what they should do.

  What should the Lead Assessor tell the OSC Assessment Official?

  A. The OSC must obtain a CAGE code before the assessment can proceed; the C3PAO cannot assist with this process.
  B. The assessment can proceed without a CAGE code, as it is not a strict requirement for CMMC certification.
  C. The C3PAO will assist the OSC in obtaining a CAGE code to ensure the assessment can continue as planned.
  D. The OSC should request a waiver from the DoD to proceed without a CAGE code.
  A. The OSC must obtain a CAGE code before the assessment can proceed; the C3PAO cannot assist with this process.