Get Cyber AB CMMC-CCA Exam Practice Questions - Real and Updated

Answer : C

The CMMC Assessment Process (CAP) requires that when sensitive or proprietary materials are exchanged during an assessment, the OSC and the C3PAO should establish confidentiality protections through a Non-Disclosure Agreement (NDA).

Extract:

''OSC and C3PAOs are expected to execute a Non-Disclosure Agreement (NDA) to protect sensitive information such as proprietary, attorney-client privileged, or pre-patent materials shared during the assessment process.''

Thus, the NDA is the correct document.

Answer : C

Applicable Requirement: SC.L2-3.13.7 --- ''Prevent split tunneling for remote devices connecting to organizational systems.''

Assessment Method: ''Examine'' requires direct review of system hardware, software, and architecture to verify split tunneling is disabled.

Why C is Correct: This aligns with the NIST SP 800-171A assessment objective, which specifies verifying that mechanisms enforcing the prevention of split tunneling are implemented at the system level.

Why Other Options Are Insufficient:

A: Describes ''test'' method, not ''examine.''

B: Describes ''interview'' method, not ''examine.''

D: Too general and vague; does not align to evidence required under ''examine.''

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- SC.L2-3.13.7

NIST SP 800-171A --- SC.L2-3.13.7 (Assessment Objectives & Examine Method)

CMMC Assessment Guide -- Level 2, SC.L2-3.13.7

===========

Answer : B

The Assessment Guide emphasizes that a policy is insufficient unless it is implemented consistently across all applicable assets. Evidence from interviews showing exceptions means the practice is NOT MET.

Extract:

''Policies must not only exist but must also be enforced and implemented consistently. Exceptions indicate non-compliance.''

Thus, the correct answer is B.

Answer : C

The Assessment Plan (planning agreement) must be signed by both the Lead Assessor and the OSC Assessment Official. This formalizes agreement on scope, resources, and methodology. The C3PAO is responsible for overall oversight but does not co-sign the plan.

Exact extracts:

''The Lead Assessor is responsible for developing the Assessment Plan in collaboration with the OSC Assessment Official.''

''Both the Lead Assessor and the OSC Assessment Official must sign the Assessment Plan to proceed.''

''The C3PAO maintains responsibility for quality assurance and submission, but not signing.''

Why other options are incorrect:

A/B: Both signatures are required, not one alone.

D: The C3PAO does not sign the planning agreement.

CMMC Assessment Process (CAP), Assessment Planning.

===========

Answer : A

Applicable Requirement (CAP -- Scoping and Evidence Validation): When inconsistencies arise about the environment, assessors are required to examine objective artifacts that define boundaries, such as network diagrams and system architecture documentation.

Why A is Correct: Network diagrams objectively show whether systems are hosted on-premises or involve ESPs (cloud, MSSPs, hosting providers). Reviewing them avoids ambiguity from inconsistent verbal descriptions.

Why Other Options Are Insufficient:

B: Interviewing another OSC representative may add to confusion rather than resolve it.

C: Interconnection agreements confirm ESP relationships but do not resolve whether the OSC has on-prem or hybrid environments.

D: Contacting ESPs directly is not part of the assessment process; OSC must provide evidence.

Reference (CCA Official Sources):

CMMC Assessment Process (CAP) v1.0 --- Clarifying System Boundaries

CMMC Assessment Guide -- Level 2 --- Evidence Types (network diagrams, architecture documentation)

===========