Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 81:

  You are the Lead Assessor for an upcoming CMMC assessment with an OSC. You meet with the OSC's Assessment Official to identify and manage any potential conflicts of interest (COIs) that may arise. You explain the importance of avoiding or mitigating COIs to maintain objectivity and impartiality throughout the assessment process. Together, you review the CMMC Code of Professional Conduct and discuss any circumstances that could create a real or perceived COI for you or the assessment team members. What is the primary responsibility of the Lead Assessor regarding conflicts of interest?

  A. Developing mitigation plans independently for any identified COIs.
  B. Ensuring that all assessment team members sign the "Absence of Conflict-of-Interest Confirmation Statement."
  C. Identifying potential COIs and documenting them in the Pre-Assessment Plan.
  D. Submitting the signed "Absence of Conflict-of-Interest Confirmation Statement" to the CMMC Accreditation Body.
  C. Identifying potential COIs and documenting them in the Pre-Assessment Plan.

• Question 82:

  When assessing a contractor's implementation of CMMC practices, you examine its SystemSecurity Plan (SSP) to identify its documented measures for audit reduction and reporting. They have a dedicated section in their SSP addressing the Audit and Accountability requirements. You proceed to interview their information security personnel, who informed you that the contractor has a dedicated Security Operations Center (SOC) and uses Splunk to reduce and report audit logs. What key features regarding the deployment of Splunk for AU.L2-3.3.6 ?Reductionand; Reporting would you be interested in assessing?

  A. Ensure that Splunk is configured with appropriate RBAC to restrict access to log data, reports, and dashboards, ensuring that only authorized personnel can view or modify audit logs
  B. Ensure Splunk can retain audit records for a protracted amount of time
  C. Ensure that Splunk employs various filter rules for reducing audit logs to eliminate non- essential data and processes to analyze large volumes of log files or audit information, identifying anomalies and summarizing the data in a format more meaningful to analysts, thus generating customized reports
  D. Ensure Splunk can support compliance dashboards that provide real-time visibility into CMMC compliance status
  C. Ensure that Splunk employs various filter rules for reducing audit logs to eliminate non- essential data and processes to analyze large volumes of log files or audit information, identifying anomalies and summarizing the data in a format more meaningful to analysts, thus generating customized reports

• Question 83:

  While examining a contractor's audit and accountability policy, you realize they have documented types of events to be logged and defined content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activities. After the logs are analyzed, the results are fed into a system that automatically generates audit records stored for 30 days. However, mechanisms implementing system audit logging are lacking after several tests because they produce audit logs that are too limited. You find that generated logs cannot be independently used to identify the event they resulted from because the defined content specified therein is too limited. Additionally, you realize the logs are retained for 24 hours before they are automatically deleted. All of the following are required to satisfy AU.L2-3.3.1 ?System Auditing assessment objectives [b] and [d], EXCEPT?

  A. Process identifiers
  B. Failure or success indications
  C. Timestamps
  D. File permissions
  D. File permissions

• Question 84:

  You are performing an on-site assessment for a defense contractor that develops and manufactures embedded control systems for military drones. During your documentation review, you discover they have a System Security Plan (SSP) outlining a configuration management process. The SSP mentions the creation of baseline configurations for their drone control systems, but details are limited. You interview the IT manager responsible for configuration management. They explain they use a commercial configuration management tool to capture hardware and software configurations for the drone systems. They confirm that the baseline configurations include initial software versions but do not track firmware or network configurations. Additionally, while they update software versions through the tool, they do not have a documented process for reviewing and updating baseline configurations in response to security vulnerabilities or system modifications. Which of the following actions would be the MOST appropriate recommendation for the contractor to improve their compliance with CM.L2-3.4.1 ?System Baselining?

  A. Developing and documenting a process for reviewing baseline configurations periodically and updating them to reflect changes in firmware versions, network topology, and security risks
  B. Instruct IT personnel to update baseline configurations whenever a new software version is deployed
  C. Replace their commercial configuration management tool with a different solution
  D. Increase the frequency of software updates for the drone control systems
  A. Developing and documenting a process for reviewing baseline configurations periodically and updating them to reflect changes in firmware versions, network topology, and security risks

• Question 85:

  As the Lead Assessor conducting a CMMC Level 2 assessment for an OSC, the Assessment Team has thoroughly reviewed all evidence provided by the OSC for the in- scope CMMC practices. Throughout the assessment process, daily checkpoint meetings were held with the OSC to allow them to present additional evidence and clarify any concerns. After the final evidence review and discussions, the Team has determined that 92 out of the 110 CMMC Level 2 practices have been scored as `MET.' Additionally, 18 practices have been scored as `NOT MET,' with 5 of those practices deemed ineligible for a Plan of Action and Milestones (POAandM) due to their potential impact on network exploitation or CUI exfiltration. The OSC has provided a draft POAandM for the remaining 13 `NOT MET' practices, outlining their proposed remediation actions and timelines. In reviewing the OSC's draft POAandM, you notice that one of the proposed remediation actions involves implementing a new security control that could potentially impact the effectiveness of another practice that was scored as `MET.' How should you proceed?

  A. Note the concern but allow the POAandM to proceed, as the impact on other practices can be reassessed during the next CMMC assessment.
  B. Accept the POAandM as it is, provided that the proposed remediation timelines are reasonable.
  C. Request the OSC to revise the POAandM, removing any actions that could limit the effectiveness of practices scored as `MET.'
  D. Reject the entire POAandM and require the OSC to resubmit it with all necessary corrections.
  C. Request the OSC to revise the POAandM, removing any actions that could limit the effectiveness of practices scored as `MET.'

• Question 86:

  An OSC uses a cloud-based database for storing customer information. Employees access this database through a secure application on their company laptops. The database itself resides on servers managed by the Cloud Service Provider (CSP). When employees use the application to access customer data, what type of location are they reaching?

  A. A secure area within the OSC's data center
  B. A logical location on the CSP's servers
  C. A specific room within the CSP's facility
  D. The physical location of the company laptops
  B. A logical location on the CSP's servers

• Question 87:

  During an assessment, it is uncovered that a CCA worked as a consultant for the OSC through their RPO. Unfortunately, the CCA didn't disclose this when their C3PAO appointed them to participate in the assessment. Did the CCA behave professionally? If not, what issues are likely to arise?

  A. Yes, the CCA behaved professionally.
  B. No, lack of objectivity.
  C. No, assessor bias.
  D. No, breach of confidentiality.
  C. No, assessor bias.

• Question 88:

  John has just passed the CCA examination and is looking to gain real-world knowledge. You are a CCA working for a leading C3PAO and a friend of John's, and he hears that you are conducting a CMMC assessment and wants to learn about how some documents are completed. He asks if you could provide a CA-RR document you completed during your current engagement to help him understand how various fields are filled out. Which of the following is the most appropriate course of action?

  A. Redact any confidential information from the CA-RR document before sharing it with John.
  B. Decline to share any assessment documents with John.
  C. Provide John with blank CA-RR templates instead of completed documents.
  D. Share the completed CA-RR document with John.
  B. Decline to share any assessment documents with John.

• Question 89:

  During a CMMC assessment, the Lead Assessor discovers that the OSC has outsourced its incident response to a third-party provider. The OSC provides a contract with the provider but no detailed evidence of the provider's processes. What should the Lead Assessor do?

  A. Accept the contract as sufficient evidence of incident response compliance.
  B. Request detailed evidence from the third-party provider demonstrating how they meet the CMMC incident response practice objectives.
  C. Score the incident response practice as "NOT MET" due to insufficient evidence.
  D. Terminate the assessment until the OSC implements incident response internally.
  B. Request detailed evidence from the third-party provider demonstrating how they meet the CMMC incident response practice objectives.

• Question 90:

  You are the CCA working with a client to deliver certified consulting services, and the OSC has asked how to ensure their scope is accurate. You mention the use of a data flow diagram, which intrigues the OSC. What would be the first step in constructing the data flow diagram for the OSC?

  A. Implement a Data Loss Prevention (DLP) tool to monitor data flows within the OSC
  B. Conduct interviews with key stakeholders to understand the organization's business processes
  C. Identify how data flows through the OSC's business, including systems, subprocesses, and data stores, identifying major inputs and outputs to the environment
  D. Gather information about the OSC's network infrastructure and create a network diagram
  C. Identify how data flows through the OSC's business, including systems, subprocesses, and data stores, identifying major inputs and outputs to the environment