Download Cyber AB CMMC-CCA Exam Dumps to Pass Exam Easily in 2026 [Q57-Q78]

NEW QUESTION 57
As a CCA, you were the Lead Assessor for a C3PAO Assessment Team that has just completed a CMMC assessment for an OSC. However, an individual has requested under the FOIA that your C3PAO release the assessment results. As the Lead Assessor, your C3PAO wants to hear your views on this request. What should your recommendation be?

Release a redacted version of the assessment results.

Refer the FOIA request to the CMMC Accreditation Body for guidance and a decision on whether to release the assessment results.

Release the full assessment results.

Deny the request and do not release any assessment information.

NEW QUESTION 58
While examining a contractor’s audit and accountability policy, you realize they have documented types of events to be logged and defined content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activities. After the logs are analyzed, the results are fed into a system that automatically generates audit records stored for 30 days. However, mechanisms implementing system audit logging are lacking after several tests because they produce audit logs that are too limited. You find that generated logs cannot be independently used to identify the event they resulted from because the defined content specified therein is too limited. Additionally, you realize the logs are retained for
24 hours before they are automatically deleted. Which of the following is a potential assessment method for AU.L2-3.3.1 – System Auditing?

Examine procedures addressing audit record generation

Testing procedures addressing control of audit records

Testing the system configuration settings and associated documentation

Examining the mechanisms for implementing system audit logging

NEW QUESTION 59
When interviewing a contractor’s CISO, they inform you that they have documented procedures addressing security assessment planning in their security assessment and authorization policy. The policy indicates that the contractor undergoes regular security audits and penetration testing to assess the posture of its security controls every ten months. The policy also states that after every four months, the contractor tests its incident response plan and regularly updates its monitoring tools. Impressed by the contractor’s policy implementation, you decide to chat with various personnel involved in security functionalities. You realize that although it is documented in the policy, the contractor has not audited their security systems in over two years. How many points would you score the contractor’s implementation of the practice CA.L2-3.12.1 – Security Control Assessment?

-5

-3

-1

5

NEW QUESTION 60
The Daily Checkpoint meeting is a required component of the CMMC assessment process. It is conducted at the end of every day and includes the Assessment Team, Lead Assessor, OSC PoC, OSC Assessment Official, and other key personnel. This meeting helps ensure all the following, EXCEPT?

Data collection needs are being met.

Issues impacting the completion of the assessment are identified, mitigated, and resolved.

The C3PAO Assessment Team is comfortable.

The assessment is proceeding as planned.

NEW QUESTION 61
An OSC creates standard user accounts with limited capabilities and administrator accounts with full system access. A standard user initiates the uninstall of the anti-virus software, which is organizationally defined as a privileged function. Which of the following would indicate AC.L2-3.1.7: Privileged Functions is properly implemented?

The antivirus software is not uninstalled.

The antivirus software is successfully uninstalled.

The antivirus software is not uninstalled, and the attempt is captured in an application audit log.

The antivirus software is successfully uninstalled, and the event is captured in an application audit log.

NEW QUESTION 62
When validating an OSC’s proposed CMMC assessment scope, the Assessment Team finds that the OSC has properly categorized its assets. The OSC has contracted an External Service Provider (ESP) for various cybersecurity functions. The ESP has deployed FortiSIEM and Splunk for real-time security monitoring, threat intelligence, application monitoring, log management, and reporting. They also deployed Microsoft Intune and configured app protection policies blocking proscribed apps and those suspected of data exfiltration. How should you handle the ESP during the CMMC assessment?

Assess against CMMC practices.

Assess them against CA.L2-3.12.4 – System Security Plan only.

Review the SSP per practice CA.L2-3.12.4 – System Security Plan.

They are out of scope; there is no need to assess them against CMMC practices.

NEW QUESTION 63
An OSC is undergoing a CMMC assessment by a C3PAO. The assessment team has been on-site for several days, reviewing the OSC’s systems, policies, and procedures against the CMMC requirements. Each day, the assessment team holds a “daily checkpoint” meeting with the OSC’s security team and representatives. This checkpoint serves an important purpose in the overall assessment process. What is the significance of the Daily Checkpoint meeting in the CMMC assessment process?

It allows the Lead Assessor to finalize the assessment findings independently.

It is optional and not necessary for the assessment process.

It is solely for updating the OSC on the assessment progress.

It provides an opportunity for the Assessment Team to review and verify additional evidence.

NEW QUESTION 64
An Assessor is evaluating controls put in place by an OSC to restrict the use of privileged accounts. The Assessor interviews privileged users and confirms that the OSC has both a policy and specific procedures governing the use of privileged accounts for security functions. What else could the Assessor evaluate to validate the assertions made by the interviewed OSC staff?

Examine the system architecture of the OSC to identify privileged accounts

Test the processes for non-privileged accounts to perform privileged functions

Examine the procedure assigning privileged roles to non-privileged functions

Test the processes for privileged accounts with privileged users

NEW QUESTION 65
CMMC practice MA.L2-3.7.3 – Equipment Sanitization requires organizations to sanitize equipment leaving their facilities for off-site maintenance for CUI. What standard would the OSC use to sanitize various media?

NIST SP 800-53

NIST SP 800-88

NIST SP 800-171

NIST SP 800-171A

NEW QUESTION 66
A CCA is assessing the implementation of the Incident Reporting practice. To validate the control, what MUST the CCA ensure about the OSC?

Incidents are tracked and documented

Incident sources are configured and tuned

Law enforcement officials are automatically notified during an incident

Forensic investigations are performed to determine the impact of the incident

NEW QUESTION 67
While conducting an assessment, an assessor is determining if privileged accounts are used for non-privileged functions. While interviewing a user with a privileged account, the assessor should ask if the person interviewed:

Knows which other users have privileged accounts

Is knowledgeable of role-based access control privileges

Uses their privileged account to research vulnerabilities on the Internet

Can show how IT staff provision privileged and non-privileged accounts

NEW QUESTION 68
You are the Lead Assessor for a CMMC Level 2 assessment. The OSC has provided a list of assets in scope, but during a site visit, you discover additional systems handling CUI that were not included in the initial scope. What should you do?

Proceed with the assessment based on the original scope provided by the OSC.

Request the OSC to revise the scope to include the additional systems and provide relevant evidence.

Terminate the assessment due to the OSC’s failure to accurately define the scope.

Include the additional systems in the assessment without informing the OSC.

NEW QUESTION 69
A CCA is assessing an Organization Seeking Certification (OSC). During the assessment, they discover that the OSC is pressuring the CCA to overlook certain security practices that do not meet the CMMC requirements. The organization threatens to withhold payment if the CCA does not modify her findings at the request of the OSC. According to the CoPC, which of the followingactions would be most appropriate for the CCA to take in this situation?

Inform the OSC that the pressure to compromise her values is a violation of the CoPC and report the issues to the C3PAO.

Complete the assessment and then report the OSC’s unethical practices to the Cyber AB.

Comply with the organization’s requests to avoid the risk of non-payment and complete the assessment.

Discuss the concerns with the OSC, continue the assessment, and report the violations only if they are not resolved.

NEW QUESTION 70
An OSC specializing in developing directed energy systems plans to bid on a DoD contract to produce a
250kW High Energy Laser Weapon System (HELWS). This system is to be deployed on military bases across the globe to protect U.S. servicemen against aerial threats, including mortars, rockets, and unmanned aerial vehicles (UAVs), as well as swarms of mini-UAVs. Because of the sensitivity of the information, the OSC has prohibited using emails to transmit information regarding the project, whether encrypted or otherwise.
They also have instituted procedures to remove CUI from the email system. What CMMC assessment requirements must the Assessment Team follow regarding the OSC’s email system?

Since there are measures in place to prevent CUI transfer through email, the email system is out of scope and there is no need to assess it against CMMC practices.

The Assessment Team must assess the email system against all CMMC practices.

Review the SSP in accordance with practice CA.L2-3.12.4 – System Security Plan.

Review the SSP in accordance with CA.L2-3.12.4 – System Security Plan and assess against other CMMC practices.

NEW QUESTION 71
An assessor is reviewing whether an organization appropriately analyzed the security impact of a new release of an application. Which of the following documents is MOST useful for the assessor to review?

A description of the change from the software vendor

Change Control Board (CCB) meeting minutes and supporting documents

System audit logs showing that the change occurred, when, and by whom

A log of security incidents/issues after the change was implemented

NEW QUESTION 72
In order to assess whether an OSC meets AC.L2-3.1.5: Least Privilege, what should be examined by the Assessor?

Authentication policy

System configurations for all systems

User access lists that identify privileged users

List of terminated employees over the last three months

NEW QUESTION 73
During a CMMC Assessment, the assessor is determining if the Escort Visitors practice is MET. Personnel with which of the following responsibilities would be MOST appropriate to interview?

Repair and facilities maintenance

Local access control and information security

Physical access control and information security

Information technology management and operations

NEW QUESTION 74
An OSC is planning a CMMC Level 2 assessment that your C3PAO will conduct. In Phase 1.6.1 – Access and Verify Evidence, as the Lead Assessor, you are verifying the existence and accessibility of the evidence provided by the OSC. While reviewing the list of evidence mapped against the CMMC practices, you discover that the OSC cannot locate several critical system security policies for key IT systems supporting their DoD contracts. These missing policies are essential for demonstrating compliance with various CMMC practices related to access control, incident response, and system maintenance. What is the primary role of the CMMC Quality Assurance Professional (CQAP) regarding the Pre-Assessment Form?

To verify the accuracy and completeness of the information before uploading to CMMC eMASS.

To assign roles and responsibilities for each Assessment Team member.

To schedule CMMC eMASS training sessions for C3PAO representatives.

To configure access controls within the CMMC eMASS system.

NEW QUESTION 75
An OSC employs guards to protect the manufacturing shop where the magnetic radar-absorbing coating is manufactured. The Army uses this specific coating for a particular fleet of unmanned aerial vehicles (UAVs).
The facility is under constant surveillance with the help of HD CCTVs. Within the OSC’s facilities is a Vector Network Analyzer (VNA) that measures the reflection and transmission properties of the coating over a range of frequencies. Guards protect the OSC’s anechoic chamber, and anyone entering must use an iris scanner and sign a physical form detailing their name and reason for being there. At the door is a huge sign reading “Authorized Personnel Only.” The OSC has implemented the following physical separation methods to secure its facilities, EXCEPT?

Signage

Monitoring

Biometric locks

Guards

NEW QUESTION 76
An OSC has recently obtained an ISO 27001 certification and a FedRAMP Authorization to Operate (ATO) for its information systems. During the initial stages of the CMMC Assessment Process, the OSC claims that these certifications should grant them automatic credit or exemption from certain CMMC requirements. As the Lead Assessor, what should be your response?

Proceed with the CMMC Assessment as planned, disregarding the OSC’s claim about their ISO 27001 and FedRAMP certifications.

Request the OSC to provide evidence of their ISO 27001 and FedRAMP certifications and then consult with the CMMC Accreditation Body to determine if any credit or exemption can be granted.

Accept the OSC’s claim and grant them appropriate credit or exemption based on their ISO 27001 and FedRAMP certifications.

Inform the OSC that their ISO 27001 and FedRAMP certifications do not bestow any status or credit towards their CMMC assessment or certification.

NEW QUESTION 77
An OSC seeking Level 2 certification is migrating to a fully cloud-based environment. The organization wants to select a Cloud Service Provider (CSP) that can share responsibilities for CMMC Level 2 requirements. Assume both CSPs can equally provide the technical capabilities and business value required.
* CSP A has SOC 2 certification and is California Consumer Privacy Act (CCPA) and Health Insurance Portability and Accountability Act (HIPAA) compliant.
* CSP B has SOC 2 and FedRAMP Moderate certifications.
Based on this information, which CSP is MOST LIKELY to be acceptable?

CSP A

CSP B

Both CSP A and B

Neither CSP A nor B

NEW QUESTION 78
Both the SSP and network diagrams presented to the Lead Assessor by the OSC indicate managed service providers (MSPs) within the assessment boundary. In order to BEST understand the impact of the MSPs, what should the Lead Assessor do?

Ascertain what employees the MSP has onsite

Request the customer responsibility matrix related to the MSPs

Review the inventory to see how the assets have been classified

Inspect the other initial documents presented including policies and organization charts