CCA Exam - Free Cyber AB Questions and Answers

Question #11 (Topic: Exam A)

During preparations for a CMMC Level 2 Assessment, a client submits a request to their consulting RP to learn more about Specialized Asset requirements. The client is not sure if their camera system, used for safety data collection purposes within their machining shop, should be documented within the SSP. Which reason is a satisfactory reason to EXCLUDE the camera system from the SSP, and thus the assessment scope?

A. The video data are deleted every seven days. B. The camera data are uploaded to a FedRAMP MODERATE authorized cloud storage system. C. The camera system network is physically and logically isolated and does not capture data related to controlled projects. D. The Technology Control Plan does not address the camera system.

Answer: C

Question #12 (Topic: Exam A)

An OSC has an HQ site and satellite offices A and B. The two satellite offices are connected to the HQ through a point-to-point VPN. CUI is stored within the HQ LAN room and used by staff at the HQ and Site A. When categorizing assets for this assessment, assets at the HQ:

A. and Site A contain CUI assets and Site B is out of scope. B. and Site A contain CUI assets and Site B contains only Certification in Risk Management Assurance. C. and Site A and Site B contain CUI assets since all have access to CUI. D. contain CUI assets and Site A and Site B contain only Certification in Risk Management Assurance.

Answer: B

Question #13 (Topic: Exam A)

An OSC is a wholly owned subsidiary of a large conglomerate (parent organization). The OSC and the parent organization use ID badges (PKI cards) that contain a PKI certificate and radio frequency identification (RFID) tag that is used for building and system access (including ones used to process, transmit or store CUI). However, the parent organization does not make any decisions on how the OSC runs its security program or any other decisions of significant importance. The large conglomerate runs a machine that is used to activate the badges for itself and the OSC. It is isolated in a locked room and has no network connectivity to the OSC. The badge activation system is:

A. in-scope because the parent organization acts as a Supporting Organization/Units to the OSC by providing PKI cards. B. out-of-scope because the OSC is the one that assigns the appropriate access to a particular PKI card. C. in-scope because the OSC is part of the large conglomerate and thus any CMMC requirements of the OSC are imputed onto the large conglomerate. D. out-of-scope because the badge activation machine is physically and logically isolated from the OSC and it is under the control of the parent organization.

Answer: D

Question #14 (Topic: Exam A)

An OSC seeking Level 2 certification is working with an ESP. The organization is trying to determine if the ESP is considered to be within the assessment scope and is reviewing the Service Level Agreement (SLA) between the organization and the ESP. Which SLA component should be taken into consideration to determine if the ESP is within the assessment scope?

A. Intervals B. Services C. Measurements D. Penalties

Answer: B

Question #15 (Topic: Exam A)

While examining the customer responsibility matrix submitted by the OSC for one of its Cloud Service Providers (CSPs), the Assessor notes that the matrix was substantially completed by the OSC’s RPO. In fact, there is a statement from the RPO that the CSP has met the requirements for FedRAMP MODERATE. In order to accept that this CSP is in fact, qualified to perform some of the practices on behalf of the OSC, what should occur?

A. The OSC should provide the contract documents for the CSP specifying that it must meet NIST SP 800-171 practices. B. The CSP must have its service certified for FedRAMP by a certified C3PAO. C. The OSC must be able to demonstrate that the CSP is providing its services in a manner that complies with CMMC Level 2. D. There must be other evidence that an independent firm has confirmed the security controls meeting FedRAMP MODERATE are in place for the CSP.

Answer: D

Cyber AB CCA - CMMC Certified Assessor Exam