Reading notes is one thing; sitting a timed test is another. The Fast2test desktop and online test engines for CMMC-CCA recreate the pressure of exam day, and every one of the 152 practice questions can be reviewed afterwards until the reasoning sticks.

Cyber AB CMMC-CCA Exam Overview:

Cyber AB CMMC-CCA Exam Syllabus Topics:

Cyber AB CMMC-CCA Exam — Your Questions, Answered

Cyber AB Certified CMMC Assessor (CCA) Sample Questions:

Question 1

An Assessor is evaluating whether an OSC has implemented adequate controls to meet AC.L2-3.1.7:
Privileged Functions. The OSC has procedures that define privileged vs. non-privileged account provisioning and an access control policy that restricts execution of certain functions only to privileged users.
What might the Assessor do to further evaluate the implementation of this practice?

A. Test whether the application of a patch is captured in system logging.
B. Examine a user access list for users that are authorized to access a key management system.
C. Test whether a non-privileged user can log into a system where CUI is stored.
D. Examine system logs to verify automatic updates are being applied.

Question 2

The OSC has not implemented cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission, citing the use of alternative physical safeguards.
Which of the following is NOT an alternative physical safeguard in this scenario?

A. Tamper protections technologies
B. Physical access site monitoring
C. Trusted couriers
D. Lockable casings

Question 3

During a company's assessment, the CCA notices that the server room door is kept open with a fan in the entryway because the cooling system is inadequate and the machines are overheating. According to the physical protection policy, the server room's keypad is the mechanism for managing and controlling access to this equipment, and only the IT team should have access to the server room. However, with the door open, the keypad is not necessary, and anyone can enter the room.
The CCA asks the IT manager how access to this room is protected while the door is open. Which response would allow the company to still meet the physical security requirement?

A. "The CEO emailed all employees that the server room door would be kept open but only the IT team should enter."
B. "We trust our employees not to enter the room if they are not supposed to."
C. "Only employees are allowed in this area."
D. "The server is located inside another room that only the IT team has access to."

Question 4

The OSC's network consists of a single unmanaged switch that connects all devices, including OT equipment which cannot run a vendor-supported operating system. The OSC correctly scoped the OT equipment as a Specialized Asset, listed it in their inventory and SSP, and provided a network diagram showing plans to isolate the OT and apply additional security measures. What information does the Lead Assessor still require to ensure compliance?

A. Installation and configuration documentation for the OT to ensure it was correctly built
B. Evidence that the network isolation is completed by the end of the assessment as well as supporting evidence for all other applicable CMMC practices
C. Wording in the SSP detailing how the OT is managed using the OSC's risk-based security policies, procedures, and practices
D. Wording in the scoping document detailing how the OT adheres to all other applicable CMMC practices

Question 5

A CCA is conducting an interview with an OSC team member about an offering from a well-known Cloud Service Provider (CSP). The offering is known to be secure, but the OSC has not provided evidence and the person being interviewed is unsure how the offering works. Will this offering be accepted by the Assessment Team?

A. Yes, because the CSP offering is a well-known, secure offering
B. Yes, because of the process of reciprocity
C. No, because the OSC lacks adequate and sufficient evidence
D. No, the OSC failed to train on the offering

Solutions: