Free Certified CMMC Assessor (CCA) Exam Practice Questions

Question # 41

When a CCA is assessing a control through Examine, what MUST they meet?

Options:

Documents utilized for review must be in their mailed form

Documents must be policy, process, and procedure documents

Training materials reviewed can be in-process as they are for educational purposes

System-level, network, and data flow diagrams must be completed in draft format

Discussion 0

Question # 42

In an effort to understand whether the OSC appropriately defined the scope to exclude items that should not be assessed, which description does NOT belong in the scope?

Options:

Data center in another state used by the OSC

A smoke detector that is connected to the OSC network

The SIEM tool used by the managed service provider in managing the OSC

The office where its managed service provider’s management office is located

Discussion 0

Question # 43

A CCA is assessing the concept of least functionality in accordance with CM.L2-3.4.6: Least Functionality.

Which method is the LEAST LIKELY to be useful as an assessment technique?

Options:

Interview personnel with information security responsibilities.

Interview personnel with application development responsibilities.

Interview personnel who wrote the configuration management policy.

Interview personnel with security configuration management responsibilities.

Discussion 0

Question # 44

While conducting a CMMC Level 2 Third-Party Assessment of a small defense contractor, an assessor discovers that the contractor’s Information Security Policy has no documented change records demonstrating executive approval. The IT director states that they will add change records in the future, but that other evidence exists. Which documentation is MOST able to demonstrate persistent and habitual adherence to CMMC requirements?

Options:

Handwritten notes from executive committee meetings discussing implementation

Several years’ worth of saved emails from the executive team approving policies and directing adherence

A notarized letter from the previous CEO stating that they approved information security policies annually

Transcribed interviews with new employees discussing their understanding of information security policies

Discussion 0

Question # 45

A company receives data that they suspect is CUI, but it is not marked as such. What is an acceptable way for the company to handle unmarked potential CUI?