Cyber AB CMMC-CCA Practice Exam Questions

Cyber AB CMMC-CCA Sample Question Answers

Question # 1

ESPs are exceptionally common today, given that many organizations are turning to securecloud offerings to establish and maintain compliance. Integral to these relationships is aresponsibility matrix, which defines who is responsible for specific items such as security.This can be a very complex assortment of taskings associated with federal compliance, butwhat is the MOST important thing to remember?

A. The ESP is technically not part of the DIB and has no responsibility to be CMMCcompliant in its own right. 
B. The CMMC Assessment Team will factor in any documentation provided by the ESPwhen evaluating the OSC for compliance. 
C. The relationship of an OSC with an ESP is a partnership and the CMMC Assessmentwill evaluate the ESP at the same time as the OSC. 
D. Only the OSC is being assessed for compliance, and while the ESP may have a lot ofresponsibilities in the matrix, the OSC is ultimately responsible for meeting therequirements as specified by government mandates. 

Show Answer

Question # 2

In order to assess whether an OSC meets AC.L2-3.1.5: Least Privilege, what should beexamined by the Assessor?

A. Authentication policy 
B. System configurations for all systems 
C. User access lists that identify privileged users 
D. List of terminated employees over the last three months

Show Answer

Question # 3

An OSC is preparing for an assessment and wants to gather evidence that will be used bythe Lead Assessor to determine the scope of the assessment. The OSC currently operatesa hybrid network, with part of their infrastructure at their physical location and part of theirinfrastructure in a cloud environment. What evidence should the OSC collect that would assist the Lead Assessor indetermining cloud and hybrid environment constraints?

A. Subnetworks list 
B. System inventory 
C. Company-owned hardware list 
D. Cloud Service Provider’s Customer Responsibility Matrix

Show Answer

Question # 4

A cloud-native OSC uses a vendor’s FedRAMP MODERATE authorized cloudenvironment for all aspects of their CUI needs (identity, email, file storage, office suite,etc.) as well as the vendor’s locally installable applications. The OSC properly configuredthe vendor’s cloud-based SIEM system to monitor all aspects of the cloud environment.The OSC’s SSP documents SI.L2-3.14.7: Identify Unauthorized Use, defining authorizeduse and referencing procedures for identifying unauthorized use. How should the Certified Assessor score this practice?

A. NOT MET because logs from physical infrastructure are not captured by the SIEM. 
B. NOT MET because locally installable applications from a cloud-native environment arenot allowed.
C. MET because being cloud-native is a great way to contain risk to a vendor’senvironment. 
D. MET because the cloud SIEM is configured to monitor all of the vendor’s cloudenvironment. 

Show Answer

Question # 5

A company describes its organization as having two systems. One system, System Org,covers the entire organization and allows instant messaging, email, and Internet activity.The other system, System CUI, is used for processing, storing, and transmitting CUI data.System CUI interfaces with System Org through security mechanisms and a firewall. The CMMC Assessment is being done on System CUI only.What is the BEST way to describe System CUI?

A. CUI Assets 
B. In-Scope Assets 
C. Out-of-Scope Assets 
D. CUI Assets and Security Protection Assets 

Show Answer

Question # 6

What should the Lead Assessor do to BEST ensure the evidence supplied effectivelymeets the intent of the standard for a practice?

A. Ensure the evidence for each objective under a practice is adequate. 
B. Ensure the evidence is sufficient to meet the requirements for a practice. 
C. Ensure the evidence is complete, validated, and can be mapped to the practicerequirements.
D. Ensure the evidence covers all the scope and the identified organizations andcorresponds to the practice and objectives. 

Show Answer

Question # 7

An OSC leases several servers and rack space in a FedRAMP MODERATE authorizedcolocation data center. Additional servers operate in a LAN room within the company’sfacility. Both facilities are within the OSC’s assessment boundary. In order to assess thephysical protection of the environment, the Assessor MUST physically examine the visitorand access controls in place in the:

A. Data center 
B. OSC’s facility 
C. OSC’s facility and the data center 
D. OSC’s facility and the data center’s customer relationship management regardingphysical security

Show Answer

Question # 8

The OSC’s network consists of a single unmanaged switch that connects all devices,including OT equipment which cannot run a vendor-supported operating system. The OSCcorrectly scoped the OT equipment as a Specialized Asset, listed it in their inventory andSSP, and provided a network diagram showing plans to isolate the OT and apply additionalsecurity measures. What information does the Lead Assessor still require to ensurecompliance?

A. Installation and configuration documentation for the OT to ensure it was correctly built 
B. Wording in the scoping document detailing how the OT adheres to all other applicableCMMC practices 
C. Wording in the SSP detailing how the OT is managed using the OSC’s risk-basedsecurity policies, procedures, and practices 
D. Evidence that the network isolation is completed by the end of the assessment as wellas supporting evidence for all other applicable CMMC practices 

Show Answer

Question # 9

An organization has contracted with a third party for system maintenance and support. Thethird-party personnel all work remotely. Which of the following should an assessor assure isin place?

A. Only third-party personnel can perform system maintenance functions. 
B. Third-party personnel need to be identified and monitored while performingmaintenance. 
C. The number of third-party personnel who can access the organization’s systemsconcurrently is limited.
D. Remote access to systems used by the third party for maintenance functions isterminated automatically based on a defined set of criteria.

Show Answer

Question # 10

During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on theOSC’s procedures around configuration management and endpoint security. The systemadministrator described how they build and deploy new systems, and noted that someusers require specialized applications for their jobs. Users have been asked to email ITwhen they install and run an additional application so IT can add it to their list of allowedsoftware. What must the CCA conclude?

A. The OSC has properly implemented application deny listing. 
B. The OSC has not properly implemented application allow listing. 
C. IT must deploy an application to report newly installed software. 
D. IT does not have a policy that users notify IT when they install new applications. 

Show Answer