Cyber AB CMMC-CCA Online Practice Questions and Exam Preparation

Cyber AB CMMC-CCA Online Questions & Answers

• Question 81:

  You are the Lead Assessor for a CMMC Level 2 assessment. The OSC has implemented a practice using a custom-built tool developed by their IT team. The tool appears to meet the practice's objectives, but no formal documentation or testing records exist.

  How should you evaluate this evidence?

  A. Accept the tool as sufficient evidence since it meets the objectives.
  B. Document the lack of documentation and testing records as an evidence gap and assess based on observed functionality.
  C. Score the practice as "NOT MET" due to the absence of formal documentation.
  D. Request the OSC to create documentation and testing records during the assessment.
  B. Document the lack of documentation and testing records as an evidence gap and assess based on observed functionality.

• Question 82:

  When examining a contractor's access control policy and SSP, you observe that system administrators routinely use accounts with elevated privileges for checking email and browsing internal websites.

  Why is it critical to implement practice AC.L2-3.1.6 - Non-Privileged Account Use?

  A. Enables easier auditing and logging of privileged activities
  B. Mitigates the consequences of a security breach by safeguarding against data loss
  C. Prevents unauthorized modification of security functions
  D. Reduces exposure to threats that might exploit the misuse of privileges
  D. Reduces exposure to threats that might exploit the misuse of privileges

• Question 83:

  During an assessment, the OSC was found to have implemented 68% of CMMC practice SC.L2-3.13.11 - CUI Encryption. However, the OSC Assessment Official cited issues with the vendor for not fully implementing the practice. Nonetheless, it has been listed in their POA&M.

  Which of the following is true regarding the use of a POA&M during a CMMC assessment?

  A. A POA&M addressing unimplemented security requirements is not a substitute for a completed CMMC practice
  B. A POA&M can be used as evidence of full implementation for any unimplemented CMMC practices
  C. If a practice is listed in the POA&M, it is considered fully implemented during the assessment
  D. Assessors are required to accept any POA&M as evidence of implementation for partially implemented practices
  A. A POA&M addressing unimplemented security requirements is not a substitute for a completed CMMC practice

• Question 84:

  An Assessor is examining documents provided by the OSC POC. While reviewing them, the Assessor notes that several of the procedures have very current dates while the bulk do not.

  What should the Assessor do in order to decide if these new documents are acceptable as evidence?

  A. Ensure the documents were approved by a senior-level manager.
  B. Determine the outlined reasonableness of the procedures.
  C. Determine if the people involved in writing the procedures are on the list of those who can be interviewed.
  D. Set up an observation session to determine if the procedures are in use and people are knowledgeable of their deployment and use.
  D. Set up an observation session to determine if the procedures are in use and people are knowledgeable of their deployment and use.

  ---

  Explanation

  Applicable Requirement (CAP Evidence Standards): Evidence must be objective and demonstrate implementation. Newly created documentation may exist only for assessment purposes, so the assessor must validate whether the documented procedures are actually in practice.

  Why Option D is Correct: Observation sessions confirm that personnel are knowledgeable about and actively following the documented procedures. This ensures the documents reflect actual implementation rather than being created solely for assessment.

  Why Other Options Are Insufficient:

  Option A: Approval shows authority but does not prove procedures are implemented.

  Option B: Subjective determination of "reasonableness" is not an approved assessment method.

  Option C: Identifying authors does not validate implementation.

  References (CCA Official Sources):

  CMMC Assessment Process (CAP) v1.0 - Evidence Collection and Triangulation CMMC Assessment Guide - Level 2, Section on Evidence Requirements NIST SP 800-171A -

  Assessment Methods: examine, interview, observe

• Question 85:

  Which of the following can be taken into consideration when assessing AC.L2-3.1.3 Privacy & Security Notices?

  A. System use notifications during system log-in
  B. Alerts received from Intrusion Detection and Protection devices
  C. Posters in the workplace warning of the dangers of phishing and shoulder-surfing
  D. Sending out notices in email reminding employees to be conscious of security concerns
  A. System use notifications during system log-in

  ---

  Explanation

  Practice AC.L2-3.1.3 requires that users are presented with privacy and security notices (system use notifications) at the point of system log-in to ensure that they are aware of authorized usage and monitoring.

  Extract:

  "Display privacy and security notices (system use notifications) before granting system access." Posters, alerts, or general awareness messages do not satisfy this practice because they are not tied directly to system access.

  References:

  CMMC Assessment Guide - Level 2, AC.L2-3.1.3.

• Question 86:

  You are a Lead Assessor working with your C3PAO to conduct a CMMC Assessment for an OSC. During the preparation and planning phase, you meet with the OSC's Assessment Official to identify the resources and schedule for the upcoming assessment. Together, you review the OSC's pre-assessment information to estimate the level of effort required. You then collaborate to determine the specific resources needed, including the Assessment Team members, facilities, and any support personnel from the OSC. You also discuss scheduling factors like duration, key activities, and potential constraints. Based on these discussions, you develop a Rough Order of Magnitude (ROM) cost estimate and a proposed daily schedule for the assessment activities.

  What is your primary responsibility in identifying resources and schedule during Phase 1?

  A. Finalizing the contract agreement between the C3PAO and OSC.
  B. Selecting the assessment team members and their roles.
  C. Determining the overall cost estimate for the assessment.
  D. Verifying that all planning requirements are met when constructing the ROM estimate.
  D. Verifying that all planning requirements are met when constructing the ROM estimate.

• Question 87:

  An OSC undergoing a CMMC Level 2 assessment provides evidence that includes a third-party audit report from a previous year. The report indicates compliance with several CMMC practices, but it does not address the current state of the OSC's systems.

  How should the Lead Assessor treat this evidence?

  A. Accept the audit report as sufficient evidence for the practices it covers.
  B. Reject the audit report as outdated and request current evidence.
  C. Use the audit report as partial evidence and request additional current evidence to verify ongoing compliance.
  D. Mark all practices covered by the report as "NOT MET" due to the lack of current data.
  C. Use the audit report as partial evidence and request additional current evidence to verify ongoing compliance.

• Question 88:

  Some OSCs share real estate with other companies.

  To protect FCI/CUI behind unmanned entrances to buildings, floors, or other areas where FCI/CUI is created, used, stored, or transmitted, which of the following is the BEST method?

  A. Turnstiles to limit access
  B. Cameras to monitor and record foot traffic
  C. Bold signage with strong language to discourage entry
  D. One-way gates which require proper credentials or intercom authorization to unlock and permit entry
  D. One-way gates which require proper credentials or intercom authorization to unlock and permit entry

  ---

  Explanation

  The Physical Protection (PE) practices require that unmanned access points to areas containing CUI be restricted with technical controls that only allow entry to authorized personnel. While cameras, signage, and turnstiles support security, they do not actually prevent access.

  Extract from PE.L2-3.10.1: "Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals."

  The strongest measure listed is one-way gates requiring credentials or intercom authorization, which directly enforces access control.

  References:

  CMMC Assessment Guide - Level 2, PE.L2-3.10.1.

• Question 89:

  During your assessment of Defcon's (a contractor) implementation of CMMC Level 2 practices, you notice that their system for displaying security and privacy notices is insufficient. The banners currently in use lack detailed information about Controlled Unclassified Information (CUI) handling requirements and associated legal implications. Additionally, the banners are not consistently displayed across all contractor systems and workstations. Moreover, the banners on login pages disappear automatically after less than 5 seconds, providing insufficient time for users to read and acknowledge the content.

  Which of the following is NOT a feature Defcon's updated privacy and security notices should have?

  A. A warning about unauthorized use being subject to civil and criminal penalties
  B. A general statement about monitoring and recording of system usage
  C. Display duration set to less than 5 seconds before automatically disappearing
  D. Specific information about the presence of CUI and associated handling requirements
  C. Display duration set to less than 5 seconds before automatically disappearing

• Question 90:

  AC.L1-3.1.2 requires OSCs to "limit information system access to the types of transactions and functions that authorized users are permitted to execute." Assessment Objective [a] of AC.L1-3.1.2 requires the Assessor to determine whether "the types of transactions and functions that authorized users are permitted to execute are defined."

  What assessment method would you use to determine whether the OSC has met this assessment objective?

  A. Interview system developers
  B. Test the system configuration settings
  C. Review the System Security Plan
  D. Examine the list of approved authorizations, including remote access authorizations
  D. Examine the list of approved authorizations, including remote access authorizations