CMMC-CCA Braindumps PDF, Cyber AB CMMC-CCA Exam Cram [Q76-Q100]

QUESTION 76
A CMMC Assessment Team is evaluating an OSC’s implementation of RA.L2-3.11.1 – Risk Assessments.
Upon examining the OSC’s Risk Assessment policy, the team learns that the OSC has specified frequencies for assessing risks to organizational operations, assets, and personnel. The results and reviews of risk assessments indicated that assessments are conducted at these defined frequencies. For the OSC’s risk assessment to be accurate, it must consider all of the following except which factor?

QUESTION 77
Before an OSC categorizes its assets into different categories, it must determine the scope of applicability.
However, after discussing with the OSC’s Point of Contact (PoC), you learn that although they follow CUI and FCI in all forms and stages, they are mostly considered technical components. What is the issue with the OSC’s approach to determining the scope of applicability?

QUESTION 78
During a readiness assessment for CoolPlanes Inc., Liz, a CCA, discovers a folder of technical drawings and illustrations of the aircraft that CoolPlanes produces. Liz has a younger brother, J.D., who loves airplanes. She thinks a large printed copy of one of the illustrations would make an excellent gift for J.D.’s birthday next month. She copies the drawing and sends it to be printed on a large canvas when she gets home. Which of the following principles of the CMMC Code of Professional Conduct did Liz most likely violate?

QUESTION 79
A Lead Assessor and the OSC have been reviewing the scope. In preparing the final assessment scope, they disagree on some areas. After several days of attempting various solutions, they cannot find common ground.
What should the CCA recommend to the C3PAO?

QUESTION 80
The audit team is discussing the OSC’s Risk Managed Assets. For these types of assets, the contractor need NOT:

QUESTION 81
An OSC plans to bid for a DoD contract to supply laser welding services to repair a fleet of unmanned aerial vehicles (UAVs). This requires them to be CMMC Level 2 certified since the information they will receive from the DoD is Controlled Technical Information (CTI). However, their repair and welding services require a Computer Numerical Control (CNC) machine to fabricate some crucial parts. Since the welding is mainly automated using robots, the OSC has intelligently integrated its SCADA system with Programmable Logic Controllers (PLCs) for increased accuracy, improved safety and efficiency, and enhanced flexibility. If the OSC wins the contract, how will the banner marking on documents containing CUI from the DoD be structured?

QUESTION 82
AC.L1-3.1.2 requires OSCs to “limit information system access to the types of transactions and functions that authorized users are permitted to execute.” Assessment Objective [a] of AC.L1-3.1.2 requires the Assessor to determine whether “the types of transactions and functions that authorized users are permitted to execute are defined.” What assessment method would you use to determine whether the OSC has met this assessment objective?

QUESTION 83
Different mechanisms can be used to protect information at rest. Which mechanism is MOST LIKELY to afford protection for information at rest?

QUESTION 84
A Lead Assessor is conducting an assessment for an OSC. The OSC is currently using doors and badge access to limit access to private areas of their campus to only authorized personnel. Which item is another means of controlling physical access to areas that contain CUI?

QUESTION 85
A vulnerability scan on a defense contractor’s system identifies a critical security flaw in a legacy database application that stores CUI. Remediating the flaw would require a complete overhaul of the application, causing significant downtime and potentially disrupting critical business functions. Given the potential consequences of remediation, the contractor is considering deferring the fix. Which course of action best aligns with the guidance of CMMC practice RA.L2-3.11.3 – Vulnerability Remediation?

QUESTION 86
You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery. What would you recommend the contractor do to avert the risk?

QUESTION 87
While scoping the assessment, the assessor learns that the OSC uses various cloud-based solutions sporadically as part of its normal course of business. The OSC states that most business is conducted on- premises and that only a small amount of business uses the cloud. The OSC thinks the cloud is only used for system backups, but there are isolated exceptions.
Are the data provided sufficient to determine that the OSC limits connection to external information systems?

QUESTION 88
An OSC creates standard user accounts with limited capabilities and administrator accounts with full system access. A standard user initiates the uninstall of the anti-virus software, which is organizationally defined as a privileged function. Which of the following would indicate AC.L2-3.1.7: Privileged Functions is properly implemented?

QUESTION 89
The Lead Assessor is ready to complete planning by developing the assessment schedule. The Lead Assessor and the OSC Assessment Official discuss the Assessment Team members.
What MUST be submitted to the Cyber-AB before the assessment?

QUESTION 90
While examining controls on the use of portable storage devices, an assessor conducts an interview with a mid-level internal system administrator. The administrator describes the process to check out portable storage devices, which includes a user emailing IT staff directly, verifying that the media classification label matches the data classification, and limiting use of the device to a specified external system.
What is a MISSING element for the assessment of AC.L2-3.1.21: Portable Storage Use?

QUESTION 91
While examining evidence, a CCA is trying to confirm the claim that the OSC has identified all information system users, processes acting on behalf of users, and all devices.
Which of the following provides the STRONGEST evidence of this practice?

QUESTION 92
You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 – Report Recommended Assessment Results. You are preparing to deliver the final recommended findings to the OSC Assessment Official and OSC participants during the Final Findings Briefing. After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?

QUESTION 93
During a CMMC assessment, the Lead Assessor discovers that the OSC has outsourced its incident response to a third-party provider. The OSC provides a contract with the provider but no detailed evidence of the provider’s processes. What should the Lead Assessor do?

QUESTION 94
You are the Lead Assessor conducting a CMMC assessment for an OSC. During the initial stages ofthe assessment, the OSC provided a comprehensive list of evidence sources, including various documents, policies, and procedures. However, as the assessment progresses, you notice that the OSC has started to rely more heavily on demonstrations and live system tests to showcase their compliance with certain CMMC practices. While these demonstrations and tests provide valuable insights, they deviate from the originally planned approach of primarily relying on documented evidence. This change in the evidence collection approach could potentially impact the assessment timeline and the overall assessment plan. As the Lead Assessor, what should you do in response to this change in the evidence collection approach?

QUESTION 95
You have been sent to assess an OSC’s implementation of CMMC practices, one of which is AC.L2-3.1.11 – Session Termination. In assessing the contractor’s implementation of AC.L2-3.1.11, you’ll likely need to examine the following specifications, EXCEPT?

QUESTION 96
During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on the OSC’s procedures around configuration management and endpoint security. The system administrator described how they build and deploy new systems, and noted that some users require specialized applications for their jobs. Users have been asked to email IT when they install and run an additional application so IT can add it to their list of allowed software.
What must the CCA conclude?

QUESTION 97
When examining a contractor’s access control policy and SSP, you observe that system administrators routinely use accounts with elevated privileges for checking email and browsing internal websites. What CMMC practice does this violate?

QUESTION 98
Assessing a DoD contractor, you observe they have implemented physical security measures to protect their facility housing organizational systems that process or store CUI. The facility has secure locks on all entrances, exits, and windows. Additionally, video surveillance cameras are installed at entry/exit points, and their feeds are monitored by security personnel. Feeds from areas where CUI is processed or stored and meeting rooms where executives meet to discuss things that have to do with CUI and other sensitive matters are segregated and stored on a designated server after monitoring. Walking around the facility, you notice network cables are hanging from the walls. To pass through a door, personnel must swipe their access cards.
However, you observe an employee holding the door for others to enter. Although power cables are placed in wiring closets, they aren’t locked, and the cabling conduits are damaged. Which of the following is NOT a concern regarding the contractor’s implementation of CMMC practice PE.L2-3.10.2 – Monitor Facility?

QUESTION 99
When interviewing a contractor’s CISO, they inform you that they have documented procedures addressing security assessment planning in their security assessment and authorization policy. The policy indicates that the contractor undergoes regular security audits and penetration testing to assess the posture of its security controls every ten months. The policy also states that after every four months, the contractor tests its incident response plan and regularly updates its monitoring tools. Impressed by the contractor’s policy implementation, you decide to chat with various personnel involved in security functionalities. You realize that although it is documented in the policy, the contractor has not audited their security systems in over two years. How many points would you score the contractor’s implementation of the practice CA.L2-3.12.1 – Security Control Assessment?

QUESTION 100
You have been hired to assess a contractor’s implementation of remote access capabilities for information systems that handle CUI. While interviewing the network administrator, you realize they perform privileged activities remotely when at alternate worksites. Which of the following is the BEST action the contractor can take to address the network administrator’s remote execution of privileged activities, as per CMMC practice AC.L2-3.1.15 – Privileged Remote Access?