Cyber AB CMMC-CCA Actual Free Exam Questions & Community Discussion

The audit team is discussing the OSC's Risk Managed Assets. For these types of assets, the contractor need NOT:

An OSC is presenting evidence of its fulfillment of CM.L2-3.4.1: System Baselining. It provides:
* System inventory records showing additions/removals of machines,
* Software inventory showing installations/removals, and
* A system component installation plan with software needs and user specifications.
What other documentation MUST the company present to illustrate compliance with CM.L2-3.4.1?

An OSC is preparing for an assessment and wants to gather evidence that will be used by the Lead Assessor to determine the scope of the assessment. The OSC currently operates a hybrid network, with part of their infrastructure at their physical location and part of their infrastructure in a cloud environment.
What evidence should the OSC collect that would assist the Lead Assessor in determining cloud and hybrid environment constraints?

The Lead Assessor concludes that the OSC is not ready for the assessment. After the Readiness Assessment Review, the OSC and the Lead Assessor could choose to:

An OSC uses an External Service Provider (ESP) to support part of its CUI processing scope. The OSC has selected an accredited ESP with FedRAMP MODERATE authorization. The OSC has a contract requiring the ESP to meet its security requirements. The ESP has provided a Shared Responsibility Matrix (SRM) consistent with the contract terms.
When assessing these assets, what should the assessor MOST carefully review?

During a company's assessment, the CCA notices that the server room door is kept open with a fan in the entryway because the cooling system is inadequate and the machines are overheating. According to the physical protection policy, the server room's keypad is the mechanism for managing and controlling access to this equipment, and only the IT team should have access to the server room. However, with the door open, the keypad is not necessary, and anyone can enter the room.
The CCA asks the IT manager how access to this room is protected while the door is open. Which response would allow the company to still meet the physical security requirement?

A manufacturing company is seeking Level 2 certification. The loading docks are currently accessible directly from the company's main parking lot, which may lead to unauthorized access to facilities. Based on this information, how should this method be modified to BEST meet Level 2 requirements?

The OSC prints out documents it receives via email that are marked as CUI. According to MP.L2-3.8.4:
Media Markings,
what should the Assessor expect to see on the printouts?

A CCA is conducting an interview with an OSC team member about an offering from a well-known Cloud Service Provider (CSP). The offering is known to be secure, but the OSC has not provided evidence and the person being interviewed is unsure how the offering works. Will this offering be accepted by the Assessment Team?

An OSC has an established password policy. The OSC wants to improve its password protection security by implementing a single change. Which of the following is an acceptable element to add to the OSC's password policy?

A company has four waterjet machines with very limited computing capabilities. The company loads CUI onto these machines for machining parts and uses CUI as necessary for machining.
Should these waterjet machines be part of the CMMC Assessment?

During a CMMC Assessment, the assessor is determining if the Escort Visitors practice is MET. Personnel with which of the following responsibilities would be MOST appropriate to interview?

An OSC outsources all of its security incident and event monitoring work to a third-party SOC. Additionally, the OSC utilizes a cloud-hosted antivirus (AV) system to fulfill the requirement of having virus protection without hosting additional servers on-site.
During the scoping discussion, both the SOC and AV should be listed as what type of asset?

In an effort to understand whether the OSC appropriately defined the scope to exclude items that should not be assessed, which description does NOT belong in the scope?