CCA

CCA practice questions, page 5 of 6, with answer review and explanations.

Question 21

An OSC has a minimal physical footprint consisting only of network equipment, workstations, and a centralized domain environment. File storage is centralized in a third-party vendor’s FedRAMP MODERATE authorized cloud environment and employees access said files using the cloud environment’s integration to the file browser on their company workstations. Due to the storage location of CUI being a FedRAMP MODERATE authorized environment, the OSC should prepare to have which of the following environments is in-scope?

  1. OSC's physical network, the cloud environment, and the cloud vendor’s employee network
  2. OSC's physical network only
  3. Cloud environment and the OSC's physical network
  4. Cloud environment only

Question 22

The OSC's network consists of a single unmanaged network switch that connects all devices. This includes the OSC's OT equipment, which due to the software vendor cannot run any vendor-supported operating system. The OSC correctly scoped the OT equipment as a Specialized Asset, listed the asset in their inventory and SSP, and provided a network diagram showing their plans to isolate the OT and apply additional security measures. What information does the Lead Assessor still require to ensure this asset is compliant?

  1. Wording in the SSP detailing how the OT is managed using the OSC's risk-based security policies, procedures, and practices
  2. Evidence that the network isolation is completed before the end of the assessment as well as supporting evidence for all other applicable CMMC practices
  3. Wording in the scoping document detailing how the OT adheres to all other applicable CMMC practices
  4. Installation and configuration documentation for the OT to ensure it was correctly built

Question 23

The client listed a Supervisory Control and Data Acquisition (SCADA) system as OT to be evaluated as part of its assessment. In reviewing network architecture and conducting interviews, the assessor determines that a firewall separates the SCADA system from the client's enterprise network and that CUI is not processed by the SCADA system. Based on this information, what is an appropriate outcome?

  1. The assessor includes all systems identified by the client as part of the assessment.
  2. The assessor determines the SCADA system is out-of-scope for the assessment.
  3. The assessor determines that all Specialized Assets are within the scope of the assessment.
  4. The assessor includes the OT within the assessment.

Question 24

A CCA is asked to validate if an OSC has separated their systems containing CUI from other departments’ systems on their local network. Which of the following MUST the CCA assess?

  1. Wide Area Network (WAN)
  2. Virtual Local Area Network (VLAN)
  3. Virtual Private Network (VPN)
  4. Network Address Translation (NAT)

Question 25

A company describes its organization as having two systems. One system, System Org, covers the entire organization and allows instant messaging, email, and Internet activity. The other system, System CUI, is the system used for processing, storing, and transmitting CUI data. System CUI interfaces with System Org through security mechanisms and a firewall. The CMMC Assessment is being done on System CUI only. What is the BEST way to describe System CUI?

  1. In-Scope Assets
  2. Out-of-Scope Assets
  3. CUI Assets and Security Protection Assets
  4. CUI Assets