Cyber AB Certified CMMC Assessor (CCA) Exam (CMMC-CCA)

What should the Lead Assessor do to BEST ensure the evidence supplied effectively meets the intent of the standard for a practice?

When a CCA is assessing a control through examination, what MUST they meet?

In order to perform a proper interview, the Lead Assessor MUST ensure interview questions are answered:

A company is undergoing a CMMC Level 2 Assessment. The Assessment Team is planning and preparing the assessment. Who is responsible for identifying methods, techniques, and responsibilities for collecting, managing, and reviewing evidence?

А C3PАO has been contracted by an OSC to perform its assessment. Before the assessment, the Lead Assessor asks the OSC to provide an extensive list of evidence, some of which is optional and beyond the minimum requirements. The OSC is not able to fulfill the entire request. One document not provided to the Assessment Team was a current and organized list of the OSC’s evidence and process mappings. Given that this is a Level 2 Assessment, what should the Lead Assessor tell the OSC?

A company is seeking Level 2 CMMC certification. During the Limited Practice Deficiency Correction Evaluation, the Lead Assessor is deciding whether the company can be moved to a POA&M review. Which condition will result in the Lead Assessor recommending moving the OSCs practice deficiencies to a POA&M review?

An OSC has contracted a C3PAO to perform a Level 2 Assessment. As the Lead Assessor is analyzing the assessment requirements, it is found that the OSC does not have a document detailing the assessment scope. How can this problem BEST be fixed?

A Lead Assessor is preparing to conduct a Level 2 Assessment for an OSC. The assessor has already determined the assessment scope and the systems included. In addition to this, the assessor requests the results of the most recent OSC Self-Assessment or any preassessments conducted by an RP/RPO, the SSP, and a list of all OSC personnel who play a role in the procedures that are in-scope. Based on the information provided, which item would the assessor MOST LIKELY request from an OSC when preparing to conduct a Level 2 Assessment?

A CCA is prohibited from doing which of the following?

The Lead Assessor and OSC Assessment Official determined the resources, cost, and schedule for an upcoming assessment. The Lead Assessor noted the OSC Assessment Official’s preferences regarding the limits of the method, and the consequent resource, cost, and schedule constraints to arrive at an optimal assessment plan. In this situation, who has responsibility for signing the framing agreement?

When preparing for an assessment, the assessor determines that the client's proprietary data resides within an enclave. However, the assessor is unable to review policies containing proprietary data onsite and plans to have the policies copied on removable media by the client's IT support staff, which they are scheduled to interview. What should the assessor consider as part of their planning?

A Lead Assessor is conducting an assessment for an OSC. The OSC is currently using door locks and badge access to limit the access to the private areas of their campus to only authorized personnel. Which item is another means of controlling physical access to areas that contain CUI?

During an assessment, the OSC person being interviewed explains the process for escorting visitors. The individual states that while all visitors are escorted, occasionally a vendor may need access to a small room with only one door and standing room only. In these cases, the escort sits in a chair outside the room and observes the vendor completing the work. Is this practice in line with the escort policy?

During an assessment interview, the interviewee states that anyone can connect to the company Wi-Fi without prior approval. Within which domains are the Wi-Fi configuration covered?

An OSC seeking Level 2 certification would like to develop and launch a website so that their customers can purchase items online and submit contact forms. The OSC plans to host the web server in their data center but also wants to maintain the security of their internal IT environment. Based on this information, what would be the BEST approach?

FIPS-validated cryptography is required to meet CMMC practices that protect CUI when transmitted or stored outside the OSC's CMMC enclave. What source does the CCA use to verify that cryptography that the OSC has implemented is FIPS-validated?

To meet AC.L2-3.1.5: Least Privilege, the following procedure is established:

1. All employees are given a basic (non-privileged) user account.

2. System Administrators are given a separate System Administrator account.

3. Database Administrators are given a separate Database Administrator account.

Which steps should be added to BEST meet all of the standards for least privilege?

The OSC being assessed prints out documents it receives via email that are marked as CUI. According to MP.L2-3.8.4: Media Markings, what should the Assessor expect to see on the printouts?

During a CMMC Assessment, the assessor is determining if the Escort Visitors practice is MET. Personnel with which of the following responsibilities would be MOST appropriate to interview?

An OSC seeking Level 2 certification has recently configured system auditing capabilities for all systems within the assessment scope. The audit logs are generated based on the required events and contain the correct content that the organization has defined. Which of the following BEST describes the next system auditing objective that the organization should define?

An OSC is undergoing CMMC Assessment on an enterprise-wide basis. While walking to the conference room, the Lead Assessor notices a printer repair technician in the hallway, unescorted, repairing a printer marked "Authorized for CUI printing." What is the NEXT step that Lead Assessor should take regarding PE.L1-3.10.3: Escort Visitors?

An OSC assigns new hires to programs on their date of hire. Human resources ensures that all screening activities are completed before the end of the employees’ first week. How should the CCA score PS.L2-3.9.1: Screen Individuals?

The OSC has not implemented cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission, citing alternative physical safeguards. Which is NOT an alternative physical safeguard in this scenario?

During an assessment, the team is interviewing the IT staff to understand the ways in which the organization protects backup data. Because the company's backups contain CUI, the Lead Assessor asks the IT engineer which method is used to ensure that the confidentiality of the backup data is being protected. Which implementation is LEAST LIKELY to be acceptable?

During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on the OSC’s procedures around configuration management and endpoint security. The system administrator described the process they use to build and deploy new systems, and they noted that some users require specialized applications for their jobs. Users have been asked to email IT when they install and run an additional application so they can add it to their list of allowed software. What MUST the CCA conclude about this evidence?

An organization has contracted with a third party for system maintenance and support. The third-party personnel all work remotely. Which of the following should an assessor assure is in place?

While conducting a CMMC Level 2 gap analysis with a large defense contractor, a CMMC RP confirms that the organization uses a RADIUS server for authentication. What additional methods could be used to comply with AC.L2-3.1.17: Wireless Access Protection?

An assessor is trying to determine if an OSC performs periodic scans of their information system and real-time scans of files from external sources as files are downloaded, opened, or executed. Which evidence is LEAST LIKELY to help this assessor?

An assessor is examining an organization’s system maintenance program. While reviewing the system maintenance policy and the OSC maintenance records for the CUI network, the assessor notices there is no mention of printers. The assessor asks the IT manager if the company has any printers. Why is the assessor concerned if the OSC has printers?

While reviewing CA.L2-3.12.1: Security Control Assessment, the CCA notices that the assessment period is defined as one year. An OSC’s SSP states per CA.L2-3.12.3 Security Control Monitoring, security controls are monitored using the same one-year periodicity to ensure the continued effectiveness of the controls. The assessor understands that some CMMC practices are able to reference other CMMC practices for the entirety of their implementation. Is the OSC’s implementation of CA.L2-3.12.3: Security Control Monitoring acceptable?