Certified CMMC Assessor (CCA) Exam
Practice Test

You are a CCA working with a client who is preparing for a CMMC assessment. The organization has requested your help in creating an information flow diagram of their document management system to ensure readiness. What would be the first step in constructing this information flow diagram? Module Major Inputs Major Outputs Document Creation Raw text, Templates Digital documents Document Storage Digital documents Archived documents Document Retrieval User requests Accessed documents Document Deletion Deletion requests Removed documents

During a CMMC Level 3 assessment, a CCA will evaluate whether the organization meets the requirement to Implement multi-factor authentication (MFA) for all network access to privileged accounts. Which assessment procedure would the CCA most likely use to evaluate this requirement?

As a CCA performing a CMMC compliance assessment, you need to verify that an organization's training practices align with cybersecurity policies in practice AC.L2-3.1.2.4. Which type of document would be the most appropriate to examine for this purpose?

While assessing a financial services company for CMMC compliance, you note that they have an advanced monitoring system logging diverse transaction anomalies and access attempts. However, the company does not have a documented process for regularly reviewing its logging policies. Interviews with their cybersecurity team reveal that they revisit the system occasionally without a predefined schedule or criteria. What is the primary benefit of implementing CMMC guidelines for regular event log review in this context?

You are evaluating a company's compliance with audit logging protection using FIPS-validated encryption to meet Level 2 requirements of the CMMC standards. What documentation cannot be provided as valid evidence of compliance?

You are evaluating Zentech Corp, a company that operates a cloud services platform handling sensitive data for numerous clients. During your review, you discover that marketing employees were able to access protected client data files. The access logs show unusual activity from multiple accounts in the "Marketing_Team" group accessing data intended only for the "IT_Security" group. Which error likely led to this unauthorized access?

You are tasked to assess a private aerospace company looking to secure CMMC certification for their work related to satellite systems. The company handles sensitive communication technologies and has implemented significant measures to mitigate insider threats. During your assessment, you learn that the company tracks anomalies such as attempts to access restricted communication channels, sudden changes in financial status among personnel, and behavioral shifts indicating potential exploitation vulnerabilities. They conduct quarterly security awareness sessions and use biometric monitoring in high-security zones. Employees with access to highly sensitive channels receive intensive insider threat awareness training. After conducting interviews with the company's CIO, who confirms the full implementation of CMMC practice AT.L2-3.2.3-Insider Threat Awareness, how would you score their program for compliance?

You are conducting a CMMC assessment for a contractor responsible for maintaining a critical supply chain network for the DoD. During the assessment of the Media Protection (MP) domain, you request a review of the contractor's access control documentation, focusing on the management of encryption and decryption keys. The contractor employs a Data Custodian role to manage these keys. However, during interviews, you discover that the Data Analysts and IT Support roles also have access to certain key management functions. When questioned about this practice, the contractor's security team explains that these roles need access for operational continuity and data processing efficiency. Based on this scenario, how would you assess the contractor's compliance with CMMC practice MP.L2-3.8.2-Key Management?

In the realm of cloud-security, organizations increasingly rely on cloud-based systems for storing and processing sensitive data. To comply with CMMC standards when using these systems, a contractor must ensure that any identifiers used are robust, consistent, and facilitate tracking within the cloud environment. As a CMMC Assessor, you are tasked with evaluating an organization's cloud security practices, specifically concerned with identifier usage for accessing cloud services. What is the primary consideration for a contractor when selecting an identifier for these cloud-based systems?

A small healthcare facility recently experienced a series of cybersecurity incidents related to unauthorized data access during system upgrade activities. The organization's IT team has been using unapproved software tools, leading to potential data breaches. As a certified CMMC assessor, you have been asked to provide a recommendation to help them meet CMMC practices, specifically regarding system maintenance control. What action should the facility take to comply with CMMC practice MA.L2-3.7.2?

An organization's incident response policy requires all security incidents to be logged within 24 hours of detection. However, a recent audit reveals that incidents are logged on average 48 hours post-detection, and some critical incidents took over 72 hours to be addressed. Based on this information, how would you score the organization's implementation of the IR domain requirement on Logging and Tracking Security Incidents?

A financial services firm is preparing for a CMMC assessment, implementing a well-defined Risk Management Framework (RMF) and utilizing continuous monitoring tools. Their policies include comprehensive data classification procedures and regular security awareness training. An independent audit verifies the existence of a regularly updated risk register and a detailed policy on accepting risks. Considering this information, how would you evaluate the firm's compliance with RM.L2-3.11.2-Risk Management practice?

In assessing an organization's incident response plan, you evaluate their list of actions upon detecting a security breach. Which of the following actions would you NOT expect to find included in the organization's immediate response protocol?

You are performing a cybersecurity assessment for a financial services company. They have quarterly audits of their applications to identify vulnerabilities but do not include source code analysis due to workflow integration challenges. Despite strong external application firewalls and regular security updates, internal reports show unresolved application layer vulnerabilities. Which of the following would be the most appropriate compensating control or mitigation for the absence of source code analysis?

A contractor is implementing a cybersecurity strategy to protect sensitive data during transmission over networks to meet CMMC compliance. The contractor has implemented several techniques, including network segmentation, secure communication protocols, and data encryption in transit. To adhere to the requirements of protecting data in transit, which strategy should the contractor NOT consider?

During a company's CMMC self-assessment, a formal risk management strategy is presented, outlining identified threats and appropriate responses. However, upon interviewing the personnel responsible for executing this strategy, it becomes clear that the actions required to mitigate these threats are either not being taken or improperly implemented. What assessment objective has the company failed to implement from CMMC practice CA.L2.3.15.3-Risk Management Strategy?

You are assessing SecureSoft Inc., a company that specializes in security software development. During your audit, you notice that certain employees have accessed a secure customer database without authorization. Upon reviewing access logs, it's evident that these unauthorized attempts weren't flagged nor reviewed by the security team. How should SecureSoft Inc. address this issue to align with AC.L2-3.1.7-Privileged Functions?

You are conducting a CMMC Level 3 assessment for a defense contractor. Upon reviewing their subcontracted services, you find that an IT vendor is responsible for key network security functions. What should you verify about this vendor? Vendor Type Vendor Certification Level IT Vendor for Network Security None Bookkeeping Service Level 2 IT Vendor for Web Hosting Level 1

An organization is preparing its documentation for a CMMC Level 3 assessment. As an assessor, you need to determine which of the following documents is not a requirement under the CMMC Model for risk-managed assets. Which document should NOT be included?

In a healthcare organization, an IT Security Specialist is responsible for overseeing data encryption processes that secure Protected Health Information (PHI) as it moves between internal databases and external partners. All PHI is stored in a cloud environment and accessed via secure remote applications. What type of asset is the IT Security Specialist?

While conducting a remote assessment session, a supplier requests the Lead Assessor to provide evidence of their CMMC training completion before proceeding to exchange sensitive documents for evaluation. What should the Lead Assessor do?

An aerospace manufacturer is undergoing a CMMC Level 3 assessment. As the Lead Assessor, you request access to the manufacturer’s Incident Response Plan (IRP) as part of the initial objective evidence for validating the scope. Which of the following is true about the aerospace manufacturer's obligations in honoring the request?

During your CMMC assessment of an organization, you find that they have effectively implemented the marking and labeling of their digital assets, but their documented guidelines do not reflect this practice. What should the organization do in this situation with respect to potential discrepancies in practice documentation?

As a CMMC Assessor conducting an evaluation, you encounter an organization that showcases its adherence to the NIST Cybersecurity Framework (NIST CSF) in its cybersecurity processes. The organization seeks to utilize this certification to expedite its CMMC certification process. How should you, as the assessor, proceed with this request?

While conducting an assessment, a CCA uncovers a significant cybersecurity vulnerability in a client's internal network that might lead to potential data breaches. The vulnerability falls outside the immediate authority of the CCA to address. What is the appropriate initial course of action for the CCA?

As a CCA, you are organizing a seminar for organizations interested in understanding CMMC requirements. You plan to distribute flyers containing the CMMC logo to attract more participants. According to the provisions of the CMMC Code of Professional Conduct (CoPC), how should you proceed?

As a CMMC Assessor, you are evaluating an organization's compliance to the Data Protection standards. During the assessment, you find they conduct Data Protection Impact Assessments (DPIAs) whenever significant changes in data processing activities occur. However, the personnel confirm that there is a documented procedure for conducting DPIAs before implementing such changes. Where should you find this information?

As a CCA, during an assessment of an organization's cybersecurity practices, you receive an email containing critical company passwords shared through an unsecured email channel by the organization's security officer. What principle of the CMMC Code of Professional Conduct is violated by this action?

A healthcare organization is planning to adopt a new cybersecurity framework. Which of the following factors should NOT be considered when selecting this framework?

A company is preparing for certification by the Cyber AB to meet CMMC standards. Before submitting their application for assessment, they need to conduct an initial evaluation of their cybersecurity policies and processes. Who is primarily responsible for conducting this evaluation?