Free Cyber AB CMMC-CCA Exam Questions
Absolute Free CMMC-CCA Exam Practice for Comprehensive Preparation
-
Cyber AB CMMC-CCA Exam Questions
-
Provided By: Cyber AB
- Exam: Certified CMMC Assessor (CCA) Level 2
- Certification: CMMC
-
Total Questions: 536
-
Updated On: Sep 04, 2026
-
Rated: 4.9 |
-
Online Users: 1072
-
Question 1
-
Any user that accesses CUI on system media should be authorized and have a lawful business purpose. While assessing a contractor?s implementation of MP.L2-3.8.2-Media Access, you examine the CUI access logs and the role of employees. Something catches your eye where an ID of an employee listed as terminated regularly accesses CUI remotely. Walking into the contractor?s facilities, you observe the janitor cleaning an office where documents marked CUI are visible on the table. Interviewing the organization?s data custodian, they informed me that a media storage procedure is augmented by a physical protection and access control policy. Based on the scenario and the requirements of CMMC practice MP.L2-3.8.2-Media Access, which of the following actions would be the highest priority recommendation for the contractor?
Answer: B
-
Any user that accesses CUI on system media should be authorized and have a lawful business purpose. While assessing a contractor?s implementation of MP.L2-3.8.2-Media Access, you examine the CUI access logs and the role of employees. Something catches your eye where an ID of an employee listed as terminated regularly accesses CUI remotely. Walking into the contractor?s facilities, you observe the janitor cleaning an office where documents marked CUI are visible on the table. Interviewing the organization?s data custodian, they informed me that a media storage procedure is augmented by a physical protection and access control policy. Based on the scenario and the requirements of CMMC practice MP.L2-3.8.2-Media Access, which of the following actions would be the highest priority recommendation for the contractor?
-
Question 2
-
A CCA has been selected to lead a team conducting a CMMC assessment for an OSC. However, it is later determined that the OSC's Point Of Contact (POC) is the CCA’s sister. Could this represent a Conflict Of Interest (COI)? If yes, what CoPC guiding principle or practice may the CCA have violated?
Answer: B
-
A CCA has been selected to lead a team conducting a CMMC assessment for an OSC. However, it is later determined that the OSC's Point Of Contact (POC) is the CCA’s sister. Could this represent a Conflict Of Interest (COI)? If yes, what CoPC guiding principle or practice may the CCA have violated?
-
Question 3
-
Upon examining a contractor's Security and awareness training policy for compliance with AT.L2-3.2.2-Role-Based Training, you determine that they offer their employees training on handling CUI securely. However, system auditors, system administrators, penetration testers, and other cybersecurity roles are all provided biannual training on CUI handling and cybersecurity best practices. In your assessment, you would rely on all of the the following evidence, EXCEPT?
Answer: C
-
Upon examining a contractor's Security and awareness training policy for compliance with AT.L2-3.2.2-Role-Based Training, you determine that they offer their employees training on handling CUI securely. However, system auditors, system administrators, penetration testers, and other cybersecurity roles are all provided biannual training on CUI handling and cybersecurity best practices. In your assessment, you would rely on all of the the following evidence, EXCEPT?
-
Question 4
-
An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1-System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet. What is the Assessment Team's initial finding regarding the OSC's implementation of CM.L2-3.4.1-System Baselining, and how should it be scored?
Answer: D
-
An OSC is undergoing a CMMC Level 2 assessment. The assessment team is reviewing the evidence for configuration management procedures per CMMC Practice CM.L2-3.4.1-System Baselining. The assessors discover that the OSC has a documented process for creating system baselines. However, upon reviewing a sample server, they find software installed that is not listed in the baseline documentation. The OSC acknowledges the discrepancy and explains that they recently deployed new security software but have not updated the baseline documentation yet. What is the Assessment Team's initial finding regarding the OSC's implementation of CM.L2-3.4.1-System Baselining, and how should it be scored?
-
Question 5
-
John, a CCA, has been assigned by his C3PAO to conduct a CMMC assessment for an OSC. During the assessment, John notices that the OSCs security practices leave much to be desired. After speaking with the OSCs IT staff, John offers to connect them with a vendor he knows who sells a vulnerability management tool that could address some of their weaknesses. According to the CMMC CoPC, which of the following best describes Johns actions?
Answer: D
-