CCA

CCA practice questions, page 4 of 6, with answer review and explanations.

Question 16

The OSC has assembled its documentation relating to how it controls remote access for assessment. The Lead Assessor has compared this documentation to the topology map provided and notes that there are several indications of external connections with ESPs. Which document is MOST LIKELY to show acceptable evidence of the security controls related to the interface between the OSC and the ESP?

  1. OSC's access control policy
  2. Instructions provided to the OSC from the ESP to implement remote access
  3. Interconnection agreement with ESPs
  4. Technical design of the security of the available VPN

Question 17

During an assessment, the Lead Assessor determines certain assets to be in-scope which the OSC considered out-of-scope. The CCA should reply that for assets to be considered out-of-scope they:

  1. can, but are not intended to, process, store, or transmit CUI.
  2. provide security protections to CUI assets.
  3. are not required to be physically or logically separated from CUI assets,
  4. do not provide security protections for CUI assets.

Question 18

A company has four waterjet machines that have very limited computing capabilities. The company loads CUI onto these machines for machining parts and modifies CUI as necessary for machining. Should these waterjet machines be part of the CMMC Assessment?

  1. Yes, these waterjet machines are CUI Assets that must be assessed because they handle CUI.
  2. No, these waterjet machines are Contractor Risk Managed Assets and do not need to be assessed under CMMC.
  3. No, these waterjet machines are Out-of-Scope Assets and do not need to be assessed.
  4. Yes, these waterjet machines are Specialized Assets that are within the scope of a CMMC Assessment.

Question 19

A company has a CUI enclave for handling all CUI processed, stored, and transmitted through the organization. While interviewing the IT manager, the CCA asks how assets that can but are not intended to handle CUI are identified. The IT manager refers to the CUI system's network diagram which includes these assets as well as the asset inventory that lists these assets and identifies them as Contractor Risk Managed Assets. Which other artifact MUST also mention these assets?

  1. The identification and authentication policy should show how these assets are identified.
  2. The physical protection policy should list these assets as being part of the physical property of the organization.
  3. The awareness and training policy should include these assets so they are called out to all employees during training.
  4. The SSP should show these assets are managed using the company’s risk-based security policies, procedures, and practices.

Question 20

A Lead Assessor is conducting an assessment for an OSC. The Lead Assessor is collecting evidence regarding the OSC's network separation techniques. Which technique would be considered a logical separation technique and would fall within the scope of the assessment?

  1. Data loss alerting configured at the edge of the network containing CUI assets
  2. A properly configured firewall that prevents data from flowing along the physical connection path
  3. Access limitation based on badge access assigned to employees based on role
  4. Role-based access control within a properly implemented identity and access management tool