Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 61:

  To comply with CMMC requirement IR.L2-3.6.3 - Incident Response Testing, organizations seeking certification (OSCs) must have a plan to regularly test their ability to respond to cyber incidents. This testing ensures that OSCs can effectively identify, contain, and recover from security breaches.

  An OSC can cite the following evidence artifacts to show compliance with the practice, EXCEPT?

  A. Evidence of regular incident response drills and response time management, recovery testing, and post-incident analysis
  B. Media sanitization plans
  C. Documentation of tabletop exercises and their outcomes
  D. Test documentation, including the scenario, response, findings, and any necessary corrective actions
  B. Media sanitization plans

• Question 62:

  The OSC POC has prepared evidence from an internal pre-assessment for the C3PAO in preparation for a third-party assessment. The OSC POC has identified that there are several ESPs (External Service Providers) involved in protecting the security of the infrastructure.

  While reviewing the pre-assessment documentation regarding ESPs, the Lead Assessor will be looking for items that are:

  A. Noted as inherited
  B. Marked as requiring a waiver
  C. Marked as NOT APPLICABLE
  D. Noted as partially implemented
  A. Noted as inherited

  ---

  Explanation

  When External Service Providers are used, the OSC can inherit practices from the ESP if sufficient evidence is provided (such as FedRAMP authorization or equivalent). The Lead Assessor must verify which controls are noted as inherited, as these are assessed differently from controls implemented directly by the OSC.

  Exact Extracts:

  CMMC Assessment Guide: "An OSC may inherit practices from External Service Providers when those providers demonstrate equivalent compliance (e.g., FedRAMP Moderate for CUI)." "Assessors must review documentation that identifies which practices are inherited, partially implemented, or implemented internally." CMMC Scoping Guide: "Inherited controls must be clearly documented by the OSC in the

  SSP."

  Why the other options are not correct:

  Option B: Waivers are not part of CMMC assessments.

  Option C: "Not Applicable" does not apply to ESP involvement; they either provide inherited practices or not.

  Option D: "Partially implemented" indicates deficiencies, not proper inheritance.

  References:

  CMMC Assessment Guide - Level 2, Version 2.13: External Service Providers and inheritance (pp. 10-13).

  CMMC Scoping Guide - Level 2: Inherited practices documentation requirements.

• Question 63:

  Your C3PAO has selected you as the Lead Assessor for the Assessment Team assessing an OSC's implementation of CMMC practices. Part of this assessment includes validating the OSC's CMMC assessment scope.

  Which of the following is NOT a factor to consider when determining which assets are in scope?

  A. Government assets transmitting CUI into the OSC's systems.
  B. Organizational assets that process CUI or FCI.
  C. Assets that secure the CUI or FCI storage location.
  D. Third-party assets that store CUI or FCI.
  A. Government assets transmitting CUI into the OSC's systems.

• Question 64:

  During your review of an OSC's system security controls, you focus on CMMC practice SC.L2-3.13.9 - Connection Termination. The OSC uses a custom web application for authorized personnel to access CUI remotely. Users log in with usernames and passwords. The application is hosted on a dedicated server within the company's internal network. The server operating system uses default settings for connection timeouts. Network security is managed through a central firewall, but no specific rules are configured for terminating inactive connections associated with the CUI access application. Additionally, there is no

  documented policy or procedure outlining a defined period of inactivity for terminating remote access connections. Interviews with IT personnel reveal that they rely solely on users to remember to log out of the application after completing their work.

  The scenario mentions that the server uses default settings for connection timeouts.

  What additional approach, besides relying solely on user awareness, could be implemented to achieve connection termination based on inactivity and comply with CMMC practice SC.L2-3.13.9 - Connection Termination?

  A. Modify the server-side application settings to automatically terminate inactive user sessions after a defined period
  B. Implement a centralized inactivity monitoring tool to identify inactive connections across the network and notify administrators for manual termination
  C. Upgrade the server operating system to the latest version, as newer versions may have stricter default timeouts for idle connections
  D. Educate users about the importance of logging out and the risks associated with leaving sessions open
  A. Modify the server-side application settings to automatically terminate inactive user sessions after a defined period

• Question 65:

  In completing the assessment of practices in the Access Control (AC) domain, a CCA scored AC.L2- 3.1.15: Privileged Remote Access as NOT MET. The OSC was notified of this deficiency at the end of day two of the assessment. On day five of the assessment, the OSC's Assessment Official contacted the CCA to provide evidence that the deficiencies have been corrected.

  What is the CCA's NEXT step?

  A. This practice is not eligible for deficiency correction and should be scored as NOT MET.
  B. This practice is not eligible for deficiency correction, should be scored as NOT MET, and reevaluated during a POA&M Close-Out Assessment.
  C. This practice is eligible for deficiency correction and should be scored as MET but must be reevaluated during a POA&M Close-Out Assessment.
  D. This practice is eligible for deficiency correction, should be scored as NOT MET, and evaluated during the Limited Deficiency Correction evaluation.
  A. This practice is not eligible for deficiency correction and should be scored as NOT MET.

  ---

  Explanation

  The CMMC Assessment Process (CAP) states that deficiency correction is not permitted during the assessment. Practices must be evaluated based on their implementation at the time of assessment. If the OSC corrects deficiencies after assessment activities have begun, the changes cannot be considered in the scoring.

  Extract:

  "Deficiency correction during the assessment is not permitted. Practices are scored based on evidence available at the time of assessment activities."

  Thus, the correct next step is to score the practice as NOT MET.

  References:

  CMMC Assessment Process (CAP), Phase 2 Rules.

• Question 66:

  A C3PAO has hired a full-time CCA and included them in an Assessment Team sent to conduct a CMMC assessment. However, as part of their agreement with Cyber AB, the CCA and, by extension, the C3PAO are expected to uphold a set of values during the assessment.

  What document sets the expectations for accredited and credentialed entities authorized to deliver CMMC services under Cyber AB licensing?

  A. Code of Professional Control
  B. CMMC Code of Professional Conduct
  C. CMMC Code of Ethical Conduct
  D. Code of Ethical Conduct
  B. CMMC Code of Professional Conduct

• Question 67:

  You are a Lead Assessor tasked with conducting a CMMC Assessment for an OSC seeking to secure its CMMC Level 2 certification. The OSC has previously conducted a self-assessment and engaged a Registered Practitioner Organization (RPO) for a preliminary evaluation. As part of the CMMC Assessment process, you begin by determining the necessary evidence for each practice or process across the OSC's organizational functional areas. You consider both the adequacy and sufficiency of the evidence in relation to the CMMC's requirements. After initial preparations, you and the OSC's POC schedule a joint review session to align on the scope and expectations for the upcoming assessment.

  What does the criterion of `Adequacy' primarily assess in the context of evidence collection for a CMMC assessment?

  A. The OSC's overall cybersecurity policy comprehensiveness.
  B. The quantity of evidence available for each CMMC practice.
  C. The evidence is relevant and demonstrates performance of a CMMC practice.
  D. The quality of the cybersecurity measures in place at the OSC.
  C. The evidence is relevant and demonstrates performance of a CMMC practice.

• Question 68:

  An OSC plans to undergo a CMMC Level 2 assessment with your C3PAO firm. As the Lead Assessor, you are collaborating with the OSC to develop the evidence collection approach for Phase 1. The OSC proposes conducting most interviews virtually due to geographically dispersed employees. You are responsible for defining the evidence collection methods for artifacts, interviews, tests or demonstrations, and information requests. Additionally, you must determine how virtual data collection will be managed, including security protocols for CUI and FCI.

  Which of the following is the most appropriate approach for artifact collection in this scenario?

  A. Use a combination of virtual document sharing and a limited on-site visit.
  B. Conduct an on-site visit to review paper and electronic artifacts.
  C. Request the OSC to upload all relevant documents to a secure cloud storage platform.
  D. Rely solely on information requests sent via email to relevant OSC personnel.
  A. Use a combination of virtual document sharing and a limited on-site visit.

• Question 69:

  As a CCA, John feels that he can make some extra cash by aggregating and rewriting CMMC materials into a book titled Acing Your CMMC Assessment: A Complete Guide. You ask him about potential issues, such as failing to get permission from The Cyber AB. John tells you that since he is a CCA, this is not a requirement, and in any case, the information is already publicly available.

  Has John violated any CoPC guiding principles or practices?

  If so, which one?

  A. No, he has not.
  B. Yes, information integrity.
  C. Yes, respect for intellectual property.
  D. Yes, adherence to materials and methods.
  D. Yes, adherence to materials and methods.

• Question 70:

  You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 - Report Recommended Assessment Results. You are preparing to deliver the final recommended findings to the OSC Assessment Official and OSC participants during the Final Findings Briefing.

  After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?

  A. The C3PAO CQAP conducts an internal quality review of the Assessment Results Package.
  B. The OSC submits an appeal using the Assessment Appeals Process if it disagrees with thefindings.
  C. You submit the Assessment Results Package directly to CMMC eMASS.
  D. You archive all assessment artifacts and dispose of them after three years.
  A. The C3PAO CQAP conducts an internal quality review of the Assessment Results Package.