Free Cyber AB CMMC-CCA Exam Dumps Questions & Answers

The Assessment Team is meeting with the OSC team and experiences a situation where some members of the OSC team describe the IT infrastructure differently from others. In some discussions, one person identifies a series of ESPs, while another describes the infrastructure as on-premises. What should the Lead Assessor do to clarify the actual operational environment?

• A.Interview an authoritative OSC representative
• B.Review the network diagrams
• C.Review the system interconnection agreements
• D.Ask for the contact information of the identified ESPs

When assessing an environment, the CCA determines that CUI is contained within an IoT device. Which statement MUST be true?

• A.Access provisioned to the IoT device must be done in accordance with AC.L2-3.1.1: Limit System Access.
• B.An IoT device may not be utilized to process, store, or transmit CUI.
• C.The IoT device must be accurately documented within the SSP.
• D.The IoT device is a Contractor Risk Managed Asset.

The assessment team is discussing the pre-assessment scope with an OSC. The OSC would like to limit the scope of the security requirements in environments that contain FCI and/or CUI. In this case, the OSC should:

• A.Choose to conduct two separate CMMC certification activities
• B.Define a CMMC Self-Assessment Scope for only those assets that process, store, or transmit CUI
• C.Request a single CMMC certification for both activities
• D.Define an Assessment Scope for those assets that process, store, or transmit FCI

In validating the OSC's implementation of AC.L2-3.1.16: Wireless Access Authorization, the CCA observes various personal and non-enterprise devices connected to the OSC's Wi-Fi. Because organizations handle wireless access differently, the CCA must locate evidence showing who has ultimate authority over wireless access. Which authority is acceptable for authorizing wireless access?

• A.The CEO mandating IT to add their personal phone to the company Wi-Fi
• B.A detailed document from the head of IT with instructions on how to connect to the guest Wi-Fi network
• C.A written policy executed by the CEO listing the pre-authorization requirements for Wi-Fi connectivity
• D.The CEO emailing the company instructing everyone to put personal devices on the company Wi-Fi

What should the Lead Assessor do to BEST ensure the evidence supplied effectively meets the intent of the standard for a practice?

• A.Ensure the evidence is complete, validated, and can be mapped to the practice requirements.
• B.Ensure the evidence covers all the scope and the identified organizations and corresponds to the practice and objectives.
• C.Ensure the evidence is sufficient to meet the requirements for a practice.
• D.Ensure the evidence for each objective under a practice is adequate.