Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 521:

  A C3PAO Assessment Team is conducting a CMMC Level 2 assessment for an OSC. During the assessment, the team finds that the OSC has not implemented a required practice due to a lack ofresources. The OSC requests a waiver from the CMMC requirements citing financial hardship.

  What should the Lead Assessor tell the OSC?

  A. The CMMC process does not allow waivers; all practices must be implemented to achieve certification.
  B. The Lead Assessor can grant a waiver if the OSC provides a detailed financial justification.
  C. The OSC can appeal to the Cyber AB for a waiver based on financial hardship.
  D. The practice can be deferred to a POA&M, allowing conditional certification.
  A. The CMMC process does not allow waivers; all practices must be implemented to achieve certification.

• Question 522:

  The Certification Assessment Readiness Review (CA-RR) aims to determine whether the OSC and the Assessment Team are ready to conduct the assessment as planned and within the allocated time.

  It addresses all of the following aspects of readiness to conduct the assessment except which one?

  A. OSC cybersecurity posture.
  B. Assessment readiness.
  C. Assessment risk status.
  D. Logistics.
  A. OSC cybersecurity posture.

• Question 523:

  A CCA was part of an Assessment Team tasked with conducting a CMMC assessment for an OSC. Happy to have been part of the team that completed the assessment, the CCA posted the OSC's assessment results on their Twitter/X account.

  Which CMMC Code of Professional Conduct (CoPC) principle has the CCA violated?

  A. Availability
  B. Proper Use of Methods
  C. Confidentiality
  D. Objectivity
  C. Confidentiality

• Question 524:

  As a Certified CMMC Assessor, you are part of a team assessing a small defense contractor. During the assessment, an employee being interviewed appears unsure about some security practices and asks for your advice on how to answer certain questions to make their compliance appear better.

  As a Certified CMMC Assessor, what should you do in this situation?

  A. Suggest that they seek guidance from another Assessor.
  B. Offer to create documentation to cover gaps in their compliance.
  C. Politely refuse to provide any assistance and continue the assessment as planned.
  D. Provide guidance on how to answer questions to maximize the appearance of compliance.
  C. Politely refuse to provide any assistance and continue the assessment as planned.

• Question 525:

  While completing the Level 2 Assessment, the Lead Assessor found that the OSC was deficient on a number of CMMC practices. Forty practices were scored as NOT MET, all on the Authorized Deficiency Corrections list. The OSC remediated 17 of those during closeout, leaving 23 practices still NOT MET.

  What should the Lead Assessor recommend?

  A. Pass the OSC but put the 23 remaining on a POA&M
  B. Fail the OSC and require them to remediate and reapply for Level 2 certification
  C. Recommend an interim certification and put the 23 remaining practices on a POA&M
  D. Recommend an interim certification and revisit the failed practices upon certification renewal
  B. Fail the OSC and require them to remediate and reapply for Level 2 certification

  ---

  Explanation

  Under CMMC 2.0 Level 2, POA&Ms are permitted only for a limited subset of practices and only if the organization achieves at least 80% compliance, with no high-weight practices failed. With 23 practices NOT MET, the OSC falls below this threshold. Therefore, the Lead Assessor must recommend a Fail, requiring remediation and reassessment.

  Exact extracts:

  "For Level 2, OSCs must achieve a score of at least 80% and cannot fail any high-weighted practices." "POA&Ms may be allowed for a small number of selected practices but must be closed within 180 days." "If the OSC does not meet minimum requirements, the assessment result is Fail and the OSC must remediate before reapplying."

  Why the other options are incorrect:

  Option A: POA&Ms cannot cover such a large number of deficiencies.

  C/Option D: Interim certification does not exist in CMMC 2.0.

  References:

  CMMC Assessment Guide - Level 2, POA&M policy.

  DoD CMMC 2.0 Program guidance on minimum passing scores and fail conditions.

• Question 526:

  Prior to starting an assessment, an OSC must develop a data flow diagram. This diagram can then be used as a tool to help establish the context and boundaries of the CMMC assessment activities.

  What is critical to capture while developing the data flow diagram?

  A. The organization's network topology and hardware configurations
  B. A list of all employees and their job functions
  C. The physical layout of the organization's office spaces
  D. Business processes, subprocesses, and assets and systems used to support the process
  D. Business processes, subprocesses, and assets and systems used to support the process

• Question 527:

  As a CCA, you are conducting an assessment of an OSC's implementation of AC.L2-3.1.7 - Privileged Functions. This requirement mandates that the organization prevent non-privileged users from executing privileged functions and capture the execution of such tasks in audit logs. During your assessment, you want to determine whether the OSC has properly defined privileged functions, as assessment objective [a] requires.

  Which Assessment Objects would you most likely examine to make this determination?

  A. Interviews with System Developers
  B. User acknowledgements of notification message or banner
  C. The organization's Privacy and Security policies and System Design documentation
  D. System use notification messages
  C. The organization's Privacy and Security policies and System Design documentation