Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 51:

  In assessing an OSC's CUI handling practices, you learn that they use an approved algorithm (AES-256) to encrypt the data to ensure its confidentiality. However, the cryptographic module they are using has not been validated under the FIPS 140 standard. The OSC believes that using an approved algorithm is sufficient to comply with the CMMC practice for CUI encryption requirements.

  Where can you find information about a cryptographic module's current status with FIPS?

  A. NIST CMVP
  B. FedRAMP Marketplace
  C. NIST CSRC
  D. FIPS 140-2 documentation
  A. NIST CMVP

• Question 52:

  You are a CCA reviewing the security measures for a defense contractor seeking CMMC Level 2 compliance. CMMC practice PE.L2-3.10.6 - Alternative Work Sites requires the organization to safeguard CUI at alternative work sites, such as employee home offices. You are examining their list of safeguards and the system security plan to assess their compliance.

  When assessing a contractor's implementation of CMMC practice PE.L2-3.10.6 - Alternative Work Sites, which of the following would be the least effective method for gathering information?

  A. Using Full Disk Encryption (FDE) or container-based encryption to encrypt CUI when stored or transmitted from or to alternate work sites
  B. Employing technologically savvy guards to man the alternate worksite
  C. Deploying a patch management and anti-malware solution for every laptop or desktop on the alternate worksite
  D. Requiring remote staff connecting to their internal networks to use a VPN that prevents split tunneling and requires multifactor authentication to verify remote users are who they claim to be
  B. Employing technologically savvy guards to man the alternate worksite

• Question 53:

  The OSC has assembled its documentation relating to how it controls remote access for assessment. The Lead Assessor compared this documentation to the provided topology map and noted several indications of external connections with External Service Providers (ESPs).

  Which document is MOST LIKELY to show acceptable evidence of the security controls related to the interface between the OSC and the ESP?

  A. OSC's access control policy
  B. Interconnection agreement with ESPs
  C. Technical design of the security of the available VPN
  D. Instructions provided to the OSC from the ESP to implement remote access
  B. Interconnection agreement with ESPs

  ---

  Explanation

  Applicable Requirement (CMMC/NIST): Multiple practices may apply (e.g., AC.L2-3.1.14 "Control remote access sessions" and CA.L2-3.12.4 "Develop, document, and periodically update system security plans").

  However, when an OSC uses an External Service Provider (ESP), the key control is the documented agreement defining the terms, conditions, and responsibilities between the OSC and the ESP.

  Why Interconnection Agreement is Correct (supports B): According to the CMMC Assessment Guide (Level 2), acceptable evidence for external connections with ESPs includes "interconnection security agreements, memoranda of understanding, or contracts that define the security requirements governing the connection."

  These agreements document controls at the interface boundary and ensure both parties understand their responsibilities for protecting CUI.

  Why Other Options Are Insufficient:

  Option A: OSC's access control policy - An internal policy outlines organizational expectations, but it does not constitute binding evidence of controls at the boundary with an ESP.

  Option C: Technical design of VPN security - Technical configurations demonstrate how connections are secured, but they do not formally document agreed security requirements between OSC and ESP.

  Option D: Instructions from ESP

  - ESP-provided setup instructions are not evidence of the OSC's validated control implementation or responsibility-sharing agreement.

  Assessment Process Alignment:

  The CMMC Assessment Process (CAP) requires assessors to confirm not only technical implementations but also documented agreements that establish accountability for safeguarding CUI. Evidence such as interconnection agreements is specifically highlighted as objective evidence that the OSC has verified and controlled external system interfaces.

  References (CCA Official Sources):

  CMMC Assessment Guide - Level 2, Version 2.13 - External Service Providers and Evidence Requirements for External Connections NIST SP 800-171 Rev. 2 - 3.1.20 and 3.13.6 (discussions on external system connections and interconnection agreements) NIST SP 800-171A - Assessment Methods for verifying security of external system interfaces

• Question 54:

  An OSC has recently obtained an ISO 27001 certification and a FedRAMP Authorization to Operate (ATO) for its information systems. During the initial stages of the CMMC Assessment Process, the OSC claims that these certifications should grant them automatic credit or exemption from certain CMMC requirements.

  As the Lead Assessor, what should be your response?

  A. Proceed with the CMMC Assessment as planned, disregarding the OSC's claim about their ISO 27001 and FedRAMP certifications.
  B. Request the OSC to provide evidence of their ISO 27001 and FedRAMP certifications and then consult with the CMMC Accreditation Body to determine if any credit or exemption can be granted.
  C. Accept the OSC's claim and grant them appropriate credit or exemption based on their ISO 27001 and FedRAMP certifications.
  D. Inform the OSC that their ISO 27001 and FedRAMP certifications do not bestow any status or credit towards their CMMC assessment or certification.
  D. Inform the OSC that their ISO 27001 and FedRAMP certifications do not bestow any status or credit towards their CMMC assessment or certification.

• Question 55:

  An OSC is a wholly owned subsidiary of a large conglomerate (parent organization). The OSC and the parent organization use ID badges (PKI cards) that contain a PKI certificate and a radio frequency identification (RFID) tag used for building and system access (including systems that process, transmit, or store CUI). The parent organization does not make any decisions on how the OSC runs its security program or other matters of significance. The large conglomerate operates a machine that is used to activate the badges for both itself and the OSC. This machine is isolated in a locked room and has no network connectivity to the OSC.

  The badge activation system is:

  A. In-scope because the parent organization acts as an External Service Provider to the OSC by providing PKI cards.
  B. In-scope because the OSC is part of the large conglomerate and thus any CMMC requirements of the OSC are imputed onto the large conglomerate.
  C. Out-of-scope because the OSC is the one that assigns the appropriate access to a particular PKI card.
  D. Out-of-scope because the badge activation machine is physically and logically isolated from the OSC and it is under the control of the parent organization.
  D. Out-of-scope because the badge activation machine is physically and logically isolated from the OSC and it is under the control of the parent organization.

  ---

  Explanation

  According to CMMC Scoping Guidance, assets controlled by a parent organization are out-of-scope when they are physically and logically isolated from the OSC's environment and do not process, store, or transmit CUI within the OSC's boundary.

  Extract from Scoping Guidance: "Out-of-Scope assets are those that cannot process, store, or transmit CUI because they are physically or logically separated from CUI assets, or they are inherently unable to do so." Since the badge activation machine is completely isolated and managed by the parent organization, and it has no network connectivity to the OSC, it is out-of-scope.

  References:

  CMMC Scoping Guidance, Level 2.

• Question 56:

  NIST SP 800-171A specifies the assessment methods for defining the nature and the extent of a CCA's actions.

  What is the purpose of the test assessment method?

  A. To review, inspect, observe, or analyze assessment objects
  B. To review compliance with an applicable standard and security assurance claims
  C. To exercise assessment objects under specified conditions to compare actual with expected behavior
  D. To execute a systematic process, procedure, or technique for obtaining security assurance evidence and consistently verifying security assurance claims
  C. To exercise assessment objects under specified conditions to compare actual with expected behavior

  ---

  Explanation

  The test assessment method means the assessor actively exercises or stimulates the system (or object) under defined conditions to compare actual results with expected behavior. This goes beyond review or observation and involves hands-on validation.

  Exact Extracts:

  NIST SP 800-171Option A: "The test method is the process of exercising assessment objects under specified conditions to compare actual with expected behavior."

  CMMC Assessment Guide: "Testing requires assessors to observe the execution of functions, mechanisms, or activities to confirm effectiveness."

  Why the other options are not correct:

  Option A: This defines Examine (not Test).

  Option B: This aligns with Interview or compliance review, not Test.

  Option D: This is a generic definition but does not capture the essence of Test (direct execution under conditions).

  References:

  NIST SP 800-171Option A: Appendix D, Assessment Methods (Examine, Interview, Test).

  CMMC Assessment Guide - Level 2, Version 2.13: Use of test assessment methods.

• Question 57:

  During an assessment interview, the interviewee states that anyone can connect to the company Wi-Fi without prior approval.

  Within which domains is the Wi-Fi configuration covered?

  A. Media Protection (MP), Access Control (AC), and Physical Protection (PE)
  B. Identification and Authentication (IA), Media Protection (MP), and System and Information Integrity (SI)
  C. Access Control (AC), Identification and Authentication (IA), and System and Communications Protection (SC)
  D. System and Communications Protection (SC), System and Information Integrity (SI), and Physical Protection (PE)
  C. Access Control (AC), Identification and Authentication (IA), and System and Communications Protection (SC)

  ---

  Explanation

  Access Control (AC): Wi-Fi access must be restricted to authorized users and devices. CMMC Level 2 incorporates NIST SP 800-171 AC requirements to limit and control access to systems and resources.

  Identification and Authentication (IA): Wireless access requires authentication to ensure only authorized individuals/devices can connect (e.g., WPA2-Enterprise, certificates, or strong passwords).

  System and Communications Protection (SC): Wi-Fi encryption and secure configuration protect data-in-transit from interception or unauthorized disclosure.

  Why Other Options Are Incorrect:

  Option A (MP, AC, PE): Media protection and physical protection are not primary domains for Wi-Fi configuration.

  Option B (IA, MP, SI): Media protection and system/information integrity do not directly address Wi-Fi security.

  Option D (SC, SI, PE): Physical and integrity controls are not central to wireless access security.

  References (CCA Official Sources):

  CMMC Model v2.0 - Domains AC, IA, SC NIST SP 800-171 Rev. 2 - AC.L2-3.1.1, IA.L2-3.5.3, SC.L2-3.13.8 (wireless access, identification / authentication, protection of communications) NIST SP 800-171A - Associated assessment objectives verifying Wi-Fi control and encryption

• Question 58:

  SecureNet is a mid-sized company that designs and manufactures access control systems for government buildings. These systems utilize Internet of Things (IoT) devices embedded within the access control panels for real-time remote monitoring. SecureNet is undergoing a CMMC Level 2 assessment to comply with new government contracting requirements. During the scope validation stage, the Certified CMMC Assessor (CCA) will review SecureNet's proposed assessment scope with the IT team. The scope includes all servers, workstations, and laptops within SecureNet's network. However, there is no mention

  of the IoT devices within the access control panels.

  Which of the following asset categories is most likely to encompass the in-scope IoT devices used in SecureNet's access control systems?

  A. Security Protection Asset (SPA)
  B. Specialized Assets
  C. Hardware Assets
  D. Contractor Risk Managed Asset (CRMA)
  B. Specialized Assets

• Question 59:

  During your assessment of CA.L2-3.12.3 - Security Control Monitoring, the contractor's CISO informs you that they have established a continuous monitoring program to assess the effectiveness of their implemented security controls. When examining their security planning policy, you determine that they have a list of automated tools they use to track and report weekly changes in the security controls. The contractor has also established a feedback mechanism that helps them identify areas for improvement in their security controls. During discussions with employees, you understand that the contractor regularly invites resource persons to train them on the secure handling of information and identifying gaps in implemented security controls.

  You would rely on all of the following evidence to assess the contractor's implementation of CA.L2-3.12.3 - Security Control Monitoring, EXCEPT?

  A. Records/logs of monitoring activities over time
  B. Customer feedback on the contractor's security measures
  C. Reports or dashboards from the monitoring activities
  D. The contractor's security monitoring policies and procedures
  B. Customer feedback on the contractor's security measures

• Question 60:

  To verify the scope accuracy and integrity, a Lead Assessor asks for documents supporting some elements of the scope. However, the OSC states that the information is proprietary and requires that the Lead Assessor sign a Non-Disclosure Agreement (NDA) before granting access.

  What should the Lead Assessor do?

  A. File a complaint with the CMMC Accreditation Body (the Cyber AB).
  B. File a complaint with the CMMC Accreditation Body (the Cyber AB).
  C. Sign the NDA and handle the proprietary information with utmost care.
  D. Inform the OSC that they have a legitimate right to access that information without signing the NDA.
  C. Sign the NDA and handle the proprietary information with utmost care.