Important Cyber AB CMMC-CCA Exam Questions

Answer: B

Explanation:

Public-facing systems (such as web servers) must be separated from internal enterprise networks to limit exposure. CMMC (aligned with NIST SP 800-171 SC.L2-3.13.5 ''Boundary Protection'') specifies that placing public servers into a demilitarized zone (DMZ) provides a security buffer and prevents direct access from the internet into the internal LAN.

Exact extracts:

''Publicly accessible systems should be placed on separate subnets or in DMZs.''

''Boundary protection devices should separate public servers from the enterprise network.''

''DMZs provide layered protection for internet-facing assets.''

Why the other options are incorrect:

A: Relocating the server physically does not provide network-layer security.

C: Firewall rules allowing only internal traffic would prevent public access, defeating the purpose of a public website.

D: Object reuse protections are unrelated to network boundary security.

CMMC Assessment Guide -- Level 2, SC.L2-3.13.5 ''Boundary Protection.''

NIST SP 800-171 Rev. 2, 3.13.5.

===========

Answer: C

Explanation:

Applicable Requirement: CAP -- Interview Guidance.

Why C is Correct: Interviews must be directed to personnel responsible for implementing, performing, or supporting practices to ensure accurate and objective evidence is collected.

Why Other Options Are Insufficient:

A: Yes/no questions do not provide sufficient evidence detail.

B: OSC personnel cannot ask themselves assessment questions; only assessors may conduct interviews.

D: Group interviews may be used in some cases, but CAP stresses targeted interviews for evidence reliability.

Reference (CCA Official Sources):

CMMC Assessment Process (CAP) v1.0 --- Interview Requirements

NIST SP 800-171A --- Use of Interview as an Assessment Method

Answer: D

Explanation:

Assessor conduct is governed by the CMMC Code of Professional Conduct. Proprietary or sensitive data from the OSC environment cannot leave without express written consent from the OSC's Assessment Official (AO). The AO is the authorized point of control for assessment-related data. This protects client confidentiality and maintains ethical handling of sensitive information.

Exact Extracts:

CMMC Assessor Code of Professional Conduct: ''No proprietary or sensitive information may be removed from an OSC environment without the express written consent of the OSC's designated Assessment Official.''

''Assessors are bound to protect confidentiality and may not transmit data outside of agreed assessment channels without written authorization.''

Why the other options are not correct:

A: Too absolute --- proprietary data can leave if AO provides written consent.

B: IT staff cannot authorize release of proprietary data.

C: POC is not the authority for data release --- only the Assessment Official is.

CMMC Code of Professional Conduct: Confidentiality requirements.

CMMC Assessment Guide -- Level 2: Ethical responsibilities of assessors.

Answer: C

Explanation:

The CMMC practices for cryptographic protection (SC.L2-3.13.11, SC.L2-3.13.8, etc.) require that cryptography protecting CUI must be FIPS-validated. The authoritative source for validation is the NIST Cryptographic Module Validation Program (CMVP).

Extract:

''To use cryptography in compliance with CMMC requirements, organizations must use modules validated under the NIST Cryptographic Module Validation Program (CMVP). The CMVP is the authoritative source to verify whether a cryptographic implementation is FIPS-validated.''

Answer: C

Explanation:

The Physical Protection (PE) requirements require that systems containing FCI or CUI be placed in controlled-access facilities with safeguards against unauthorized physical access.

Extract from PE.L2-3.10.1:

''Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.''

Thus, ensuring that the VMs run on hardware located in a controlled-access facility is the correct method to meet physical security requirements.