Cyber AB Certified CMMC Assessor (CCA) - CMMC-CCA Exam Practice Test

During a CMMC Assessment, the assessor is determining if the Escort Visitors practice is MET. Personnel with which of the following responsibilities would be MOST appropriate to interview?

While conducting a CMMC Level 2 self-assessment, an organization's Chief Information Security Officer asks the system administrator for evidence that remote access is routed through fully managed access control points. Which documentation would BEST demonstrate that all remote access is routed through managed access control points?

The OSC has changed its manner of operations in the past year to isolate its manufacturing division (which handles CUI) from its managerial team (which does not). Upon review of the provided information, the Lead Assessor was unable to identify this isolation in the environment. Which step should the Assessor take NEXT to understand how the current documentation isolates the operational components?

A company has a firewall to regulate how data flows into and out of its network. Based on an interview with their IT staff, all connections to their systems are logged, and suspicious traffic generates alerts. Examination of which artifact should give the CCA the details on how these are implemented?

An in-house compliance expert for a large defense contractor is reviewing the organization's training materials for personnel handling CUI. After a widely publicized insider threat incident, management requires that training address insider threat risks. What is a critical component of insider threat awareness training?

The Lead Assessor concludes that the OSC is not ready for the assessment. After the Readiness Assessment Review, the OSC and the Lead Assessor could choose to:

While conducting a CMMC Level 2 Third-Party Assessment of a small defense contractor, an assessor discovers that the contractor's Information Security Policy has no documented change records demonstrating executive approval. The IT director states that they will add change records in the future, but that other evidence exists. Which documentation is MOST able to demonstrate persistent and habitual adherence to CMMC requirements?

The OSC prints out documents it receives via email that are marked as CUI. According to MP.L2-3.8.4:
Media Markings,
what should the Assessor expect to see on the printouts?

A CCA is assessing the concept of least functionality in accordance with CM.L2-3.4.6: Least Functionality.
Which method is the LEAST LIKELY to be useful as an assessment technique?

A CCA is asked to validate if an OSC has separated their systems containing CUI from other departments' systems on their local network. Which of the following MUST the CCA assess?

The Lead Assessor is ready to complete planning by developing the assessment schedule. The Lead Assessor and the OSC Assessment Official discuss the Assessment Team members.
What MUST be submitted to the Cyber-AB before the assessment?

An OSC has a testing laboratory. The lab has several pieces of equipment, including a workstation that is used to analyze test information collected from the test equipment. All equipment is on the same VLAN that is part of the certification assessment. The OSC claims that the workstation is part of the test equipment (Specialized Asset) and only needs to be addressed under risk-based security policies. However, the OSC states that the data analysis output is CUI. What is the assessor's BEST response?

A company has five individual buildings in one business complex. During the assessment, the Assessment Team sees people entering and exiting the buildings and notices that none of the buildings have keypads or locks. The Assessment Team needs to determine how physical access is managed and controlled.
Which artifact BEST describes how access to these buildings is managed?

While conducting an assessment, an assessor is determining if privileged accounts are used for non-privileged functions. While interviewing a user with a privileged account, the assessor should ask if the person interviewed: