Free Cyber AB CMMC-CCA Practice Test & Real Exam Questions

The OSC's network consists of a single unmanaged switch that connects all devices, including OT equipment which cannot run a vendor-supported operating system. The OSC correctly scoped the OT equipment as a Specialized Asset, listed it in their inventory and SSP, and provided a network diagram showing plans to isolate the OT and apply additional security measures. What information does the Lead Assessor still require to ensure compliance?

A C3PAO has contracted by an OSC to perform its assessment. Before the assessment, the Lead Assessor asks the OSC to provide an extensive list of evidence, some of which is optional and beyond the minimum requirements. The OSC is not able to fulfill the entire request. One missing document was a current and organized list of the OSC's evidence and mappings.
Given that this is a Level 2 Assessment, what should the Lead Assessor tell the OSC?

A CCA is assessing the implementation of SC.L2-3.13.7: Split Tunneling control via the examine method.
Which scenario MUST be correct to determine if the practice is MET?

An OSC uses an External Service Provider (ESP) to support part of its CUI processing scope. The OSC has selected an accredited ESP with FedRAMP MODERATE authorization. The OSC has a contract requiring the ESP to meet its security requirements. The ESP has provided a Shared Responsibility Matrix (SRM) consistent with the contract terms.
When assessing these assets, what should the assessor MOST carefully review?

A company is seeking Level 2 CMMC certification. During the Limited Practice Deficiency Correction Evaluation, the Lead Assessor must decide whether the company can move to a POA&M review. Which condition will result in the Lead Assessor recommending that the OSC's practice deficiencies move to a POA&M review?

To meet AC.L2-3.1.5: Least Privilege, the following procedure is established:
* All employees are given a basic (non-privileged) user account.
* System Administrators are given a separate System Administrator account.
* Database Administrators are given a separate Database Administrator account.
Which steps should be added to BEST meet all of the standards for least privilege?

While examining evidence, a CCA is trying to confirm the claim that the OSC has identified all information system users, processes acting on behalf of users, and all devices.
Which of the following provides the STRONGEST evidence of this practice?

The OSC prints out documents it receives via email that are marked as CUI. According to MP.L2-3.8.4:
Media Markings,
what should the Assessor expect to see on the printouts?

The OSC has not implemented cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission, citing the use of alternative physical safeguards.
Which of the following is NOT an alternative physical safeguard in this scenario?

An OSC has a large multi-building facility. One building is used as the OSC's data center. A guard is stationed at the entrance to the data center. A vendor engineer comes onsite to perform maintenance on the storage array in the data center. The guard knows the engineer well and has the engineer fill out the visitor log with the contact person's name and phone number, the reason for the visit, and the date and time. Since the guard has known the engineer for many years, what is the BEST step the guard should take?