Cyber AB CMMC-CCA Practice Exam Questions

Cyber AB CMMC-CCA Sample Question Answers

Question # 1

CMMC practice SC.L2-3.13.6 assessment objectives [a] and [b] require contractors systems to denynetwork communications traffic by default [a] and allow network communications traffic byexception [b] respectively. As a CCA, you assess whether an OSC has segmented its network intodifferent zones. The OSC has implemented Access Control Lists (ACLs) on its network devices topermit or deny traffic based on source and destination IP addresses and ports. Additionally, the OSCuses a Fortinet Next-Generation Firewall (NGFW). To monitor their computing environment,theOSC uses a state-of-the-art SIEM. Which of the following assessment methods is NOT a methodyou would use to assess whether the OSC has met assessment objectives [a] and [b]?

A. Examine the ACL configurations on the network devices
B. Observe the SIEM monitoring and logging capabilities
C. Interview the system administrators about the organizations network segmentation strategy
D. Analyze the firewall rules and policy settings on the NGFW

Show Answer

Question # 2

As a Certified CMMC Assessor (CCA), you evaluate an OSCs implementation of the AC.L2-3.1.11 “Session Termination requirement during a CMMC Level 2 assessment. This requirement mandatesthe organization to automatically terminate a user session after defined conditions are met. Duringyour assessment, you want to determine whether the OSC has properly defined theconditions thatwould trigger the automatic termination of a user session, as required by assessment objective [a].Which of the following assessment objects would you most likely examine to make thisdetermination?

A. The organizations system audit logs and records
B. Procedures addressing identification and authentication
C. Interviews with system administrators and personnel with information security responsibilities
D. The organizations Access Control Policy and system configuration settings

Show Answer

Question # 3

Part of effective CUI protection involves knowing which assets process, transmit, or store CUI. Thisunderstanding is crucial for defining CUI boundaries within an OSCs systems. To achieve this, anOSC can prepare a logical data flow diagram for their information systems. Which of the followingquestions does a logical data flow diagram not answer?

A. How does the data recipient receive the data?
B. How is the system implemented?
C. What data is being transmitted?
D. What system, process, or individual receives the data?

Show Answer

Question # 4

An OSC uses a web application for document management. Employees can access this applicationfrom any internet-connected device through a web browser. The application resides on servers in asecure data center managed by a third-party vendor. The OSC maintains separate servers within itsnetwork to store the documents. When employees use the web application to upload documents,what type of locations are they interacting with?

A. A logical location for the web application and a physical location for the document storage servers
B. A secure area within the OSCs data center
C. The physical location of their internet-connected devices
D. The physical location of the vendors data center

Show Answer

Question # 5

An OSC uses a web application for document management. Employees can access this applicationfrom any internet-connected device through a web browser. The application resides on servers in asecure data center managed by a third-party vendor. The OSC maintains separate servers within itsnetwork to store the documents. When employees use the web application to upload documents,what type of locations are they interacting with?

A. A logical location for the web application and a physical location for the document storage servers
B. A secure area within the OSCs data center
C. The physical location of their internet-connected devices
D. The physical location of the vendors data center

Show Answer

Question # 6

During a CMMC assessment of an OSC, you discover that they rely heavily on a reputable CSP fortheir email services. As you delve deeper into the assessment, you suspect the OSC is incorrectlyassuming that the CSPs security measures are sufficient to meet all the CMMC requirements relatedto email security. Given the critical nature of email communications and the potential exposure ofsensitive information, you recognize the importance of clearly understanding the division ofresponsibilities between the OSC and the CSP for email security controls. To effectively assess howemail security responsibilities are divided between the OSC and the CSP, which document shouldyou prioritize reviewing?

A. The OSCs overall security policy
B. The Shared Responsibility Matrix (SRM) between the OSC and the CSP
C. The CSPs publicly available security documentation
D. The Service Level Agreement (SLA) between the OSC and the CSP

Show Answer

Question # 7

As a CCA, you are conducting an assessment of an OSCs implementation of AC.L2-3.1.7 “ PrivilegedFunctions. This requirement mandates that the organization prevent non-privileged users fromexecuting privileged functions and capture the execution of such tasks in audit logs. During yourassessment, you want to determine whether the OSC has properly defined privileged functions, asassessment objective [a] requires. Which Assessment Objects would you most likely examine tomake this determination?

A. Interviews with System Developers
B. User acknowledgements of notification message or banner
C. The organizations Privacy and Security policies and System Design documentation
D. System use notification messages

Show Answer

Question # 8

The OSC implements security measures to control access to printers and manage printed documents.They use a pull-printing system that requires users to authenticate at a designatedprinter to releasetheir print jobs. These printers are installed in a printing press room where only authorized personshave access. To enter the room, individuals must scan their CAC cards. The room housing the printerscan be considered what type of location?

A. Printer location
B. Logical location
C. Industrial location
D. Physical location

Show Answer

Question # 9

The OSC implements security measures to control access to printers and manage printed documents.They use a pull-printing system that requires users to authenticate at a designatedprinter to releasetheir print jobs. These printers are installed in a printing press room where only authorized personshave access. To enter the room, individuals must scan their CAC cards. The room housing the printerscan be considered what type of location?

A. Printer location
B. Logical location
C. Industrial location
D. Physical location

Show Answer

Question # 10

As the Lead Assessor for an OSC, John admires their advanced security solutions during theassessment. However, his admiration distracts him from the assessments focus. Instead, he engagesin conversation about the OSCs robust security, becoming swayed by their capabilities.Consequently, John becomes hesitant to identify deficiencies or noncompliances, displaying apositive bias toward the OSC. What is the impact of this positive bias on the CMMC assessment ofthe OSC?

A. It is not a concern in CMMC assessments
B. It may lead to a more thorough and rigorous evaluation of the OSC
C. It has no effect on the assessment process and outcomes
D. It can result in a more lenient and inaccurate assessment of the OSC

Show Answer