CCA

CCA practice questions, page 6 of 6, with answer review and explanations.

Question 26

When assessing an environment, the CCA determines that CUI is contained within an IoT device. Which statement MUST be correct?

  1. The IoT device must be accurately depicted within the SSP.
  2. An IoT device may not be utilized to process, store, or transmit CUI.
  3. Access provisioned to the IoT device must be done in accordance with AC.L1-3.1.1: Limit System Access.
  4. The IoT device is a Contractor Risk Managed Asset.

Question 27

While conducting a CMMC Level 2 Assessment for a small waveguide manufacturer, the client provides a copy of their CMMC Level 1 Self-Assessment that their senior official has recently approved and uploaded to the Supplier Performance Risk System (SPRS). What type of information may be covered within the Level 1 Self-Assessment that is OUTSIDE the scope of a Level 2 Assessment?

  1. Sensitive Compartmented Information (SCI) shredded by an approved vendor
  2. FCI data within the scope described in the contractor self-assessment
  3. CUI in paper format
  4. FCI within the CUI production enclave

Question 28

The assessment team is discussing the pre-assessment scope with an OSC. The OSC would like to limit the scope of the security requirements in environments that contain FCI and/or CUI. In this case, the OSC should:

  1. choose to conduct two separate CMMC certification activities.
  2. define a CMMC Self-Assessment Scope for only those assets that process, store, or transmit CUI.
  3. define an Assessment Scope for those assets that process, store, or transmit FCI.
  4. request a single CMMC certification for both activities.

Question 29

An OSC has a testing laboratory. The lab has several pieces of equipment, including a workstation that is used to analyze test information collected from the test equipment. All equipment is on the same VLAN that is part of the certification assessment. The OSC claims that the workstation is part of the test equipment (because of the specialized program it runs) and thus only needs to be assessed under its risk-based information security policies, procedures, and practices. However, the OSC states that the data analysis output is CUI. What is the assessor's BEST response?

  1. Agree with the OSC but perform a limited spot check of the system, not increasing the assessment cost or duration.
  2. Agree with the OSC and determine if it is managed using the contractor's risk-based information security policies, procedures, and practices.
  3. Disagree with the OSC and include the workstation in the full assessment.
  4. Disagree with the OSC and score practice CA.L2-3.12.4: System Security Plan as being NOT MET.

Question 30

An OSC is preparing for an assessment and wants to gather evidence that will be used by the Lead Assessor to determine the scope of the assessment. The OSC currently operates a hybrid network, with part of their infrastructure at their physical location and part of their infrastructure in a cloud environment. What evidence should the OSC collect that would assist the Lead Assessor in determining cloud and hybrid environment constraints?

  1. Subnetworks list
  2. Company-owned locations
  3. Cloud Service Provider’s Customer Responsibility Matrix
  4. System inventory