Free Cyber AB CMMC-CCA Practice Test & Real Exam Questions

FIPS-validated cryptography is required to meet CMMC practices that protect CUI when transmitted or stored outside the OSC's CMMC enclave. What source does the CCA use to verify that the cryptography the OSC has implemented is FIPS-validated?

A company seeking Level 2 certification has several telecommunications closets throughout its office building. The closets contain network systems and devices that are used to transmit CUI. Which method would be BEST to ensure that only authorized personnel can access the network systems and devices housed within the closets?

Phase 2 of the CMMC Assessment Process specifies that the Assessment Team shall generate the final recommended assessment results. The status and recommended scores of the implemented CMMC practices are collected throughout the assessment and are reviewed with the OSC during the final daily review.
What are the key sequential subphases that support the generation of final recommended assessment results?

The client has a Supervisory Control and Data Acquisition (SCADA) system as OT to be evaluated as part of its assessment. In reviewing network architecture and conducting interviews, the assessor determines that a firewall separates the SCADA system from the client's enterprise network and that CUI is not processed by the SCADA system. Based on this information, what is an appropriate outcome?

While conducting a CMMC Level 2 gap analysis with a large defense contractor, a CMMC RP confirms that the organization uses a RADIUS server for authentication. What additional method could be used to comply with AC.L2-3.1.17: Wireless Access Protection?

A CCA is assessing the concept of least functionality in accordance with CM.L2-3.4.6: Least Functionality.
Which method is the LEAST LIKELY to be useful as an assessment technique?

The Lead Assessor concludes that the OSC is not ready for the assessment. After the Readiness Assessment Review, the OSC and the Lead Assessor could choose to:

An OSC seeking Level 2 certification wants to develop and launch a website for customers to purchase items online and submit contact forms. The OSC plans to host the web server in their own data center while also maintaining the security of their internal IT environment. Based on this information, what would be the BEST approach?

When assessing an environment, the CCA determines that CUI is contained within an IoT device. Which statement MUST be true?

The assessment team has divided responsibilities to review portions of the OSC's scope, including the Host Unit, the specific enclave, and supporting teams such as a Managed Security Service Provider (MSSP).
During evidence review, the team notices that MSSP personnel answered interview questions somewhat differently than OSC personnel. To clarify this inconsistency, the Lead Assessor decides to take all the following steps EXCEPT: