Instant Access CyberAB.CMMC-CCA.v2026-10-02.q107 Actual Practice Test Engine for Free (Page 4)

Question 11

You are a Lead Assessor working with your C3PAO to conduct a CMMC Assessment for an OSC. During the preparation and planning phase, you meet with the OSC's Assessment Official to identify the resources and schedule for the upcoming assessment. Together, you review the OSC's pre-assessment information to estimate the level of effort required. You then collaborate to determine the specific resources needed, including the Assessment Team members, facilities, and any support personnel from the OSC. You also discuss scheduling factors like duration, key activities, and potential constraints. Based on these discussions, you develop a Rough Order of Magnitude (ROM) cost estimate and a proposed daily schedule for the assessment activities. What is your primary responsibility in identifying resources and schedule during Phase
1?

A.Finalizing the contract agreement between the C3PAO and OSC.
B.Selecting the assessment team members and their roles.
C.Determining the overall cost estimate for the assessment.
D.Verifying that all planning requirements are met when constructing the ROM estimate.

Question 12

When assessing a contractor's implementation of CMMC practices, you examine its System Security Plan (SSP) to identify its documented measures for audit reduction and reporting. They have a dedicated section in their SSP addressing the Audit and Accountability requirements. You proceed to interview their information security personnel, who informed you that the contractor has a dedicated Security Operations Center (SOC) and uses Splunk to reduce and report audit logs. What key features regarding the deployment of Splunk for AU.L2-3.3.6 - Reduction & Reporting would you be interested in assessing?

A.Ensure that Splunk is configured with appropriate RBAC to restrict access to log data, reports,and dashboards, ensuring that only authorized personnel can view or modify audit logs
B.Ensure Splunk can retain audit records for a protracted amount of time
C.Ensure that Splunk employs various filter rules for reducing audit logs to eliminate non-essential data and processes to analyze large volumes of log files or audit information, identifying anomalies and summarizing the data in a format more meaningful to analysts, thus generating customized reports
D.Ensure Splunk can support compliance dashboards that provide real-time visibility into CMMC compliance status

Correct Answer: C

Comprehensive and Detailed In-Depth Explanation:
CMMC practice AU.L2-3.3.6 - Reduction & Reporting requires organizations to "provide audit reduction and report generation capabilities to support after-the-fact investigations without altering original records." The objectives are: [a] reducing audit records by filtering non-essential data, and [b] generating reports for analysis. Splunk, a SIEM tool, is deployed, and the assessor must evaluate its alignment with these goals.
* Option C: Filter rules for reduction and analysis/reporting processes- This directly addresses the practice's core requirements: reducing logs (e.g., filtering noise) and generating meaningful reports (e.
g., anomaly detection, summaries). These features ensure Splunk meets AU.L2-3.3.6's intent, making it the key focus.
* Option A: RBAC for access restriction- Relevant to AU.L2-3.3.8 (Audit Protection), not reduction
/reporting; it's a security control, not a capability of this practice.
* Option B: Retention time- Pertains to AU.L2-3.3.2 (Audit Retention), not reduction/reporting functionality.
* Option D: Compliance dashboards- Useful but not required by AU.L2-3.3.6; the focus is on reduction and reporting, not real-time compliance visibility.
Why C?The CMMC guide specifies assessing tools for reduction (filtering) and reporting (analysis/report generation), and Splunk's effectiveness hinges on these features, per the scenario's SOC context.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), AU.L2-3.3.6: "Examine tools for capabilities to [a] reduce audit records by filtering non-essential data, and [b] generate reports identifying anomalies and summarizing data."
* NIST SP 800-171A, 3.3.6: "Assess reduction and reporting functions, such as filtering and customized report generation." Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf

Question 13

An OSC plans to undergo a CMMC Level 2 assessment with your C3PAO firm. As the Lead Assessor, you are collaborating with the OSC to develop the evidence collection approach for Phase 1. The OSC proposes conducting most interviews virtually due to geographically dispersed employees. You are responsible for defining the evidence collection methods for artifacts, interviews, tests or demonstrations, and information requests. Additionally, you must determine how virtual data collection will be managed, including security protocols for CUI and FCI. Which of the following is the most appropriate approach for artifact collection in this scenario?

A.Use a combination of virtual document sharing and a limited on-site visit.
B.Conduct an on-site visit to review paper and electronic artifacts.
C.Request the OSC to upload all relevant documents to a secure cloud storage platform.
D.Rely solely on information requests sent via email to relevant OSC personnel.

Question 14

During a CMMC Level 2 assessment, a CCA is evaluating whether the organization meets the requirement to
"Employ FIPS-validated cryptography when used to protect the confidentiality of CUI." According to the CMMC requirement, the CCA must determine whether FIPS-validated cryptography is employed to protect the confidentiality of CUI. Which assessment procedure would the CCA most likely use to evaluate this requirement?

A.Examine the cryptographic modules
B.Interview personnel responsible for implementing cryptographic controls and review documentation of the organization's cryptographic policies and procedures
C.Observe the organization's use of cryptographic controls in practice
D.Examine validation certificates of the cryptographic modules used by the OSC

Question 15

A cloud-native OSC uses a vendor's FedRAMP MODERATE authorized cloud environment for all aspects of their CUI needs (identity, email, file storage, office suite, etc.) as well as the vendor's locally installable applications. The OSC properly configured the vendor's cloud-based SIEM system to monitor all aspects of the cloud environment. The OSC's SSP documents SI.L2-3.14.7: Identify Unauthorized Use, defining authorized use and referencing procedures for identifying unauthorized use.
How should the Certified Assessor score this practice?

A.NOT MET because logs from physical infrastructure are not captured by the SIEM.
B.NOT MET because locally installable applications from a cloud-native environment are not allowed.
C.MET because being cloud-native is a great way to contain risk to a vendor's environment.
D.MET because the cloud SIEM is configured to monitor all of the vendor's cloud environment.

Question 11

Question 12

Question 13

Question 14

Question 15

Download PDF File