Cyber AB CMMC-CCA Exam Questions Instant Access

Question 1

A C3PAO has contracted by an OSC to perform its assessment. Before the assessment, the Lead Assessor asks the OSC to provide an extensive list of evidence, some of which is optional and beyond the minimum requirements. The OSC is not able to fulfill the entire request. One missing document was a current and organized list of the OSC's evidence and mappings.

Given that this is a Level 2 Assessment, what should the Lead Assessor tell the OSC?

A''The OSC's Assessment Official will be asked to collect evidence when requested by the assessment team.''

B''The OSC must provide the Assessment Team with hardcopy evidence. Electronic evidence will only be collected when needed.''

C''It's okay that the document is missing. The Assessment Team will collect all evidence themselves to ensure its integrity.''

D''The OSC should provide the Assessment Team with a current and organized list of their evidence and process mappings, but the assessment can continue.''

Answer : D

The CAP requires that the OSC provide an organized and traceable set of evidence for review. While missing an evidence map does not stop the assessment, it is a best practice and strongly recommended to improve efficiency.

Extract:

''The OSC should provide an organized list of evidence and mappings to support efficient review by the assessment team. While not strictly required, it is recommended as part of readiness for a Level 2 assessment.''

Thus, the Lead Assessor should advise the OSC to provide the evidence mapping list, but the absence does not invalidate proceeding.

Question 2

An assessor reviews the OSC's data protection policy, which requires full disk encryption on company laptops. While interviewing employees, the assessor learns that employees sometimes access data while teleworking on laptops that do not have full disk encryption.

How should the assessor view the implementation of the OSC's policy?

AAcceptable because it requires full disk encryption of company laptops.

BInsufficient because there are teleworking instances where the policy is not followed.

CAcceptable as long as an equivalent technical safeguard is implemented for all teleworking scenarios.

DInsufficient because full disk encryption is not required for laptops to comply with CMMC requirements.

Answer : B

The Assessment Guide emphasizes that a policy is insufficient unless it is implemented consistently across all applicable assets. Evidence from interviews showing exceptions means the practice is NOT MET.

Extract:

''Policies must not only exist but must also be enforced and implemented consistently. Exceptions indicate non-compliance.''

Thus, the correct answer is B.

Question 3

During the Planning Phase of the Assessment Plan, the assessor determines that the Client will likely include sensitive and proprietary CUI. What should the assessor consider as part of their virtual data collection techniques for this information?

AThe Client is responsible for safeguarding the data during collection, not the assessor.

BThe assessor is responsible for safeguarding the data during collection, not the client.

CThe assessor should record the risks and mitigations to protect the CUI categories handled.

DThe client and assessor should record the risks and mitigations to protect the CUI categories handled.

Answer : D

Applicable Requirement (CAP -- Planning Phase): Both the OSC (Client) and the CCA are responsible for protecting sensitive evidence and CUI during assessment. This includes documenting risks and mitigations for how such information is handled, especially during virtual collection.

Why D is Correct: CAP requires assessors and OSCs to jointly establish processes ensuring safeguarding of CUI evidence. Both parties must record and agree to risks and mitigations as part of the assessment plan.

Why Other Options Are Insufficient:

A & B: Responsibility is shared, not one-sided.

C: Recording by the assessor alone does not fulfill CAP's joint responsibility requirement.

Reference (CCA Official Sources):

CMMC Assessment Process (CAP) v1.0 --- Planning Phase (Handling CUI and Sensitive Evidence)

Code of Professional Conduct --- Assessor responsibility for safeguarding CUI

===========

Question 4

A CCA is conducting an interview with an OSC team member about an offering from a well-known Cloud Service Provider (CSP). The offering is known to be secure, but the OSC has not provided evidence and the person being interviewed is unsure how the offering works. Will this offering be accepted by the Assessment Team?

AYes, because of the process of reciprocity

BNo, the OSC failed to train on the offering

CNo, because the OSC lacks adequate and sufficient evidence

DYes, because the CSP offering is a well-known, secure offering

Answer : C

CMMC assessments are evidence-based. An offering cannot be accepted solely on reputation or assumptions of security. The OSC must provide adequate and sufficient evidence that the CSP offering meets CMMC requirements. Without evidence, the assessor cannot mark the practice as MET.

Exact Extracts:

CMMC Assessment Guide: ''Assessment determinations must be based on objective evidence; absence of evidence results in a finding of NOT MET.''

''Evidence may include documentation, interviews, and tests but must be sufficient to confirm implementation.''

''Reciprocity is not granted for external offerings unless evidence is provided.''

Why other options are not correct:

A (reciprocity): CMMC does not allow blanket reciprocity for cloud offerings without validation.

B (training issue): Training is separate; the core issue is lack of evidence.

D (well-known CSP): Reputation alone is not evidence; objective evidence is required.

CMMC Assessment Guide -- Level 2, Version 2.13: Evidence-based assessments (pp. 5--7).

NIST SP 800-171A: Requirement to use objective evidence.

Question 5

Does CMMC Level 2 require that a Cloud Service Provider (CSP) hold a FedRAMP HIGH authorization hosted in a government community cloud (GCC)?

ANo. The CSP can obtain a FedRAMP MODERATE equivalency.

BNo. The CSP must hold a FedRAMP MODERATE authorization.

CYes. FedRAMP HIGH is required for CUI data controls due to the sensitive nature of the Defense Industrial Base systems.

DYes. FedRAMP HIGH authorization demonstrates the CSP compliance with NIST SP 800-53 and SP 800-171 control requirements.

Answer : B

CMMC Level 2 requires CSPs that process, store, or transmit CUI to meet FedRAMP Moderate (or equivalent) authorization, not FedRAMP High. FedRAMP High is not a CMMC requirement but may be required by contract or specific agencies.

Exact Extracts:

DoD CMMC Scoping Guide: ''External Cloud Service Providers must meet FedRAMP Moderate equivalency when storing, processing, or transmitting CUI.''

CMMC Assessment Guide: ''The baseline requirement for CUI in cloud environments is FedRAMP Moderate; higher levels may be contractually required.''

Why other options are not correct:

A: Equivalency is allowed, but only to FedRAMP Moderate level.

C/D: Incorrect, because CMMC Level 2 does not mandate FedRAMP High.

CMMC Assessment Guide -- Level 2, Version 2.13: External Service Providers and FedRAMP Moderate equivalency requirements.

DoD Cloud Computing SRG (referenced in CMMC documentation): CUI requires FedRAMP Moderate baseline.

Question 6

Phase 2 of the CMMC Assessment Process specifies that the Assessment Team shall generate the final recommended assessment results. The status and recommended scores of the implemented CMMC practices are collected throughout the assessment and are reviewed with the OSC during the final daily review.

What are the key sequential subphases that support the generation of final recommended assessment results?

ADetermine final practice MET/NOT MET/NA results
Create, finalize, and record recommended final findings
Resolve assessment findings disputes

BValidate preliminary recommended findings and scores
Resolve assessment findings disputes
Submit, package, and archive assessment documentation

CCreate, finalize, and record recommended final findings
Execute POA&M review
Resolve assessment findings disputes

DDetermine final practice MET/NOT MET/NA results
Validate OSC POA&M
Create, finalize, and record recommended final findings

Answer : A

The CMMC Assessment Process (CAP), Phase 2 -- Conduct the Assessment defines the subphases for generating final recommended results. The steps are:

Determine final practice MET/NOT MET/NA results

Create, finalize, and record recommended final findings

Resolve assessment findings disputes

Extract:

''The assessment team determines the final practice status, records recommended findings, and resolves disputes with the OSC prior to finalizing recommended results.''

Question 7

While completing the Level 2 Assessment, the Lead Assessor found that the OSC was deficient on a number of CMMC practices. Forty practices were scored as NOT MET, all on the Authorized Deficiency Corrections list. The OSC remediated 17 of those during closeout, leaving 23 practices still NOT MET. What should the Lead Assessor recommend?

APass the OSC but put the 23 remaining on a POA&M

BFail the OSC and require them to remediate and reapply for Level 2 certification

CRecommend an interim certification and put the 23 remaining practices on a POA&M

DRecommend an interim certification and revisit the failed practices upon certification renewal

Answer : B

Under CMMC 2.0 Level 2, POA&Ms are permitted only for a limited subset of practices and only if the organization achieves at least 80% compliance, with no high-weight practices failed. With 23 practices NOT MET, the OSC falls below this threshold. Therefore, the Lead Assessor must recommend a Fail, requiring remediation and reassessment.

Exact extracts:

''For Level 2, OSCs must achieve a score of at least 80% and cannot fail any high-weighted practices.''

''POA&Ms may be allowed for a small number of selected practices but must be closed within 180 days.''

''If the OSC does not meet minimum requirements, the assessment result is Fail and the OSC must remediate before reapplying.''

Why the other options are incorrect:

A: POA&Ms cannot cover such a large number of deficiencies.

C/D: Interim certification does not exist in CMMC 2.0.

CMMC Assessment Guide -- Level 2, POA&M policy.

DoD CMMC 2.0 Program guidance on minimum passing scores and fail conditions.

Cyber AB Certified CMMC Assessor (CCA) CMMC-CCA Exam Questions