Important Cyber AB CMMC-CCA Exam Questions

Answer: C

Explanation:

Applicable Requirement: AC.L2-3.1.7 --- ''Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.''

Correct Interpretation:

A non-privileged (standard) user should be prevented from performing privileged functions (e.g., uninstalling security software).

The attempt must be logged to provide traceability and support accountability.

Why C is Correct: It demonstrates both prevention (software not uninstalled) and auditing (attempt captured in a log), exactly matching the practice.

Why Other Options Are Insufficient:

A: Prevention is shown, but there is no evidence of logging.

B: Function was not prevented, so requirement not met.

D: Logging exists, but privileged action was not prevented.

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- AC.L2-3.1.7

NIST SP 800-171A --- AC.L2-3.1.7 Assessment Objectives

CMMC Assessment Guide -- Level 2, AC.L2-3.1.7

===========

Answer: A

Explanation:

Per the CMMC Scoping Guidance, CUI Assets are those that process, store, or transmit CUI. Since System CUI is the system handling CUI data, it must be categorized as CUI Assets.

Extract:

''CUI Assets are any assets that process, store, or transmit CUI. These assets are in-scope for assessment and must meet CMMC practice requirements.''

Thus, the best classification for System CUI is CUI Assets.

Answer: C

Explanation:

Risk Managed Assets are not assessed against CMMC practices, but OSCs must demonstrate that they are identified and that the risk they pose to CUI is managed in accordance with organizational policies. The Scoping Guide specifies that these assets must be addressed in pre-assessment discussions and described in the scope diagram, but they are explicitly excluded from practice-by-practice assessment.

Exact extracts:

''Risk Managed Assets do not process, store, or transmit CUI but can access CUI Assets. These assets are not assessed against CMMC practices but must be discussed with the assessor.''

''Organizations must identify how these assets are managed by organizational policies.''

''Risk Managed Assets must be included in scope diagrams.''

Why the other options are incorrect:

A/B/D: Risk Managed Assets still must be documented, discussed, and managed with policies.

C: They are explicitly excluded from practice assessment.

Reference (CCA documents / Study Guide):

CMMC Assessment Scope -- Level 2 Scoping Guide (Risk Managed Assets).

===========

Answer: C

Explanation:

System baselines are part of Configuration Management (CM). Maintaining an inventory of hardware and software is important, but the evidence of managing baselines lies in the configuration management process, which establishes and documents standard system configurations, approved software, and change control. The CMMC practice CM.L2-3.4.1 requires the OSC to establish and maintain baseline configurations.

Exact extracts:

''Baseline configurations are documented, formally reviewed, and maintained as part of configuration management.''

''Assessment Objectives ... Determine if: baseline configurations are established; baseline configurations are maintained.''

''Potential Assessment Methods -- Examine: configuration management policy; documented baseline configuration; inventory of system components.''

Expanded explanation:

Hardware/software lists show what exists, but without baseline control they do not demonstrate effective management.

Configuration management evidence includes: CM policies, baselines for operating systems, software versions, patch levels, and configuration checklists.

This ensures that unauthorized changes or unapproved software do not deviate from the security posture.

Why the other options are incorrect:

A (Media protection): Relates to storage devices and handling, not baselines.

B (Physical protection): Relates to facility and hardware security, not configuration.

D (Identification and authentication policy): Addresses user access, not baseline configuration.

CMMC Assessment Guide -- Level 2, CM.L2-3.4.1 ''Establish and Maintain Baseline Configurations.''

NIST SP 800-171 Rev. 2, 3.4.1.

===========

Answer: A

Explanation:

The CMMC Assessment Process (CAP) states that deficiency correction is not permitted during the assessment. Practices must be evaluated based on their implementation at the time of assessment. If the OSC corrects deficiencies after assessment activities have begun, the changes cannot be considered in the scoring.

Extract:

''Deficiency correction during the assessment is not permitted. Practices are scored based on evidence available at the time of assessment activities.''

Thus, the correct next step is to score the practice as NOT MET.