Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 71:

  During a CMMC assessment, the OSC provides a service-level agreement (SLA) with an external provider as evidence for an inherited practice. The SLA outlines general security commitments but lacks specific details on how the practice's objectives are met. How should the Lead Assessor proceed?

  A. Accept the SLA as sufficient evidence since it shows a contractual obligation.
  B. Request additional detailed evidence from the external provider to demonstrate compliance with the practice's objectives.
  C. Score the practice as "NOT MET" due to the lack of specific details.
  D. Ask the OSC to renegotiate the SLA to include detailed compliance information.
  B. Request additional detailed evidence from the external provider to demonstrate compliance with the practice's objectives.

• Question 72:

  You were the Lead Assessor on a team that conducted a CMMC assessment for an OSC that passed and earned a CMMC L2 Certification. Meeting this requirement, the OSC bid on and won a DoD contract. However, a rival company disputes the OSC's CMMC certification status in court. As part of the evidence, the court has directed you to release the assessment results and any evidence you might have relied on to arrive at the assessment results. Based on the CoPC, what action should you take in this situation?

  A. Release the assessment results only after obtaining written permission from the OSC being assessed.
  B. Release the assessment results.
  C. Do not release the assessment results under any circumstances.
  D. Release only a summary of the assessment results.
  B. Release the assessment results.

• Question 73:

  Sarah, a Certified CMMC Assessor, is conducting an assessment for DataSecure, a cloud service provider that hosts various applications for the Defense Industrial Base (DIB). During the assessment, Sarah encounters a complex and highly specialized cloud architecture that leverages cutting-edge technologies such as containerization, serverless computing, and advanced security controls. As Sarah reviews the evidence provided by DataSecure for the relevant CMMC practices, she realizes that some of the evidence and implementations are unlike anything she has encountered in previous assessments. What is the most appropriate action for Sarah to take as a CCA in this scenario?

  A. Request DataSecure to simplify their architecture and align with more traditional IT practices for easier evaluation.
  B. Strictly adhere to a standardized assessment checklist, regardless of DataSecure's unique architecture.
  C. Defer the assessment until she can receive additional training on the specific technologies used by DataSecure.
  D. Thoroughly research and understand DataSecure's cloud architecture, seek clarification from subject matter experts, and evaluate the evidence within the context of their specialized environment.
  D. Thoroughly research and understand DataSecure's cloud architecture, seek clarification from subject matter experts, and evaluate the evidence within the context of their specialized environment.

• Question 74:

  The use of removable storage media remains a source of data breaches. The CMMC requires control of the use of removable media on system components. As a CCA, you can use different assessment methods to determine whether an OSC has met this requirement. What is the best assessment method to ascertain that MP.L2-3.8.7[a] has been met?

  A. Examining System Media Protection Policy
  B. Interviewing personnel with responsibilities for system media use
  C. Testing mechanisms that restrict or prohibit the use of removable media on systems or system components
  D. Examining System Design documentation
  C. Testing mechanisms that restrict or prohibit the use of removable media on systems or system components

• Question 75:

  Part of effective CUI protection involves knowing which assets process, transmit, or store CUI. This understanding is crucial for defining CUI boundaries within an OSC's systems. To achieve this, an OSC can prepare a logical data flow diagram for their information systems. Which of the following questions does a logical data flow diagram not answer?

  A. How does the data recipient receive the data?
  B. How is the system implemented?
  C. What data is being transmitted?
  D. What system, process, or individual receives the data?
  B. How is the system implemented?

• Question 76:

  When examining an OSC's procedures for addressing transmission integrity and confidentiality, you interview their system administrator and learn that they use Secure File Transfer Protocol (SFTP)for secure CUI transmission. The OSC employs AES-256 to encrypt data before transmitting it. Any external connections to their internal servers or systems can only occur via a VPN. All emails containing CUI are encrypted and sent using Secure/Multipurpose Internet Mail Extensions (S/MIME). Internal CUI transfers are conducted over WPA3 secure Wi-Fi. All areas of the OSC's facilities where CUI is stored or processed are secured with biometrics. To prevent unauthorized CUI exfiltration or transfer, the OSC has deployed a data loss prevention solution. During employee interviews, you learn they receive regular awareness training on the importance of data encryption during transmission. Additionally, they conduct regular audits of transmission protocols and encryption measures to ensure their effectiveness. While AES-256 is a strong encryption algorithm, according to CMMC practice SC.L2-3.13.8 ?Data in Transit, what additional factor is crucial for ensuring FIPS compliance with cryptographic modules used for protecting CUI in transit?

  A. The encryption algorithm must be open-source and publicly available for scrutiny
  B. The encryption software must be user-friendly and easy to implement for widespread adoption
  C. The cryptographic module used to implement AES-256 encryption must be validated against the FIPS 140-2 or FIPS 140-3 standards
  D. The encryption algorithm must be mathematically complex and resistant to brute-force attacks
  C. The cryptographic module used to implement AES-256 encryption must be validated against the FIPS 140-2 or FIPS 140-3 standards

• Question 77:

  A CCA is part of an Assessment Team conducting a CMMC Level 2 assessment. During an interview, an OSC employee admits that a critical security practice is not implemented because "it's too expensive." The CCA responds by suggesting a low-cost alternative solution to implement the practice. What should the CCA have done instead?

  A. Noted the employee's statement and continued the interview without offering any suggestions.
  B. Reported the employee's statement to the OSC management immediately.
  C. Encouraged the employee to discuss the issue with their supervisor after the interview.
  D. Paused the interview to consult with the Lead Assessor about the practice's cost implications.
  A. Noted the employee's statement and continued the interview without offering any suggestions.

• Question 78:

  An OSC has produced two assessment scopes. When the Lead Assessor questioned the OSC PoC why, they detailed that they process, store, or transmit FCI within one assessment scope and CUI in another. Which scope will the OSC obtain a CMMC Level 2 certification for?

  A. The scope that processes, transmits, or stores FCI
  B. The scope that transmits, processes, or stores CUI
  C. For both assessment scopes
  D. The OSC cannot be certified at Level 2 because they haven't met Level 1 requirements
  B. The scope that transmits, processes, or stores CUI

• Question 79:

  Risks are inherent in any organization. As a CCA working within an Assessment Team, you are assessing an OSC's implementation of RA practices. When evaluating RA.L2-3.11.3[b], you want to determine whether vulnerabilities are remediated in accordance with risk assessments. What Assessment Object would you likely examine to make this determination?

  A. Patch and vulnerability management records
  B. Vulnerability scanning tools and associated configuration documentation
  C. Vulnerability scanning results
  D. Security Assessment Report
  A. Patch and vulnerability management records

• Question 80:

  During an assessment, the OSC was found to have implemented 68% of CMMC practice SC.L2-3.13.11 ?CUI Encryption. However, the OSC Assessment Official cited issues with the vendor for not fully implementing the practice. Nonetheless, it has been listed in their POAandM. Which of the following is true regarding the use of a POAandM during a CMMC assessment?

  A. A POAandM addressing unimplemented security requirements is not a substitute for a completed CMMC practice
  B. A POAandM can be used as evidence of full implementation for any unimplemented CMMC practices
  C. If a practice is listed in the POAandM, it is considered fully implemented during the assessment
  D. Assessors are required to accept any POAandM as evidence of implementation for partially implemented practices
  A. A POAandM addressing unimplemented security requirements is not a substitute for a completed CMMC practice