Certified CMMC Assessor (CCA) Practice Exam

These questions are part of the practice quiz. Start practicing

• What characterizes a Temporary Deficiency in CMMC compliance?
• What defines the assets assessed during a CMMC evaluation?
• Logical separation in a system is achieved through what means?
• What does the Unique Entity Code (UEI) enable organizations to do?
• Which type of account typically has the most limited access?
• What must be included in audit records to support user activity traceability?
• Which of the following describes an Enduring Exception?
• Operational Technology (OT) primarily interacts with which environment?
• What defines a Security Domain?
• What does a Hybrid Assessment involve regarding evidence collection?
• Which of the following best describes the nature of a Process in CMMC?
• Who convenes the In-Brief Meeting before assessment activities begin?
• Which of the following is NOT a requirement for privileged accounts as per CMMC?
• Which method is NOT typically part of the sanitization process?
• Why is it important to have default-deny rules configured for public-facing subnetworks?
• What role do firewalls and proxies play in Information Flow Enforcement Mechanisms?
• What is a key requirement of AC.L2-3.1.18 regarding mobile device connections?
• What is the primary objective of security awareness training?
• Which method does Physical Separation employ for data transfer?
• What is the purpose of a Non-Disclosure Agreement (NDA) in the CMMC assessment?
• What documentation is essential for effective maintenance according to CMMC?
• What does the DoD Assessment Methodology (DoDAM) standardize?
• What is the purpose of access enforcement mechanisms?
• What must be done by the OSA regarding Security Protection Assets (SPAs)?
• What must assessors verify regarding the use of portable storage devices containing CUI?
• How should organizations approach flaw remediation as per SI.L2-3.14.1?
• What is the purpose of a Self-Assessment in the context of CMMC?
• What is the primary function of boundary control devices in network security?
• What does the central hub for incident documentation and reporting enhance according to IR.L2-3.6.2?
• Which category does NOT fall under the asset categorization required for CMMC assessment?
• What is the purpose of a Document Traceability Matrix?
• What aspect of maintenance does CMMC Level 2 emphasize in its practices?
• What type of protection must be implemented for organizational systems as per SI.L2-3.14.2?
• What function does the Artifact Hashing Tool serve in the CMMC assessment process?
• Which of the following best describes a CMMC Third-Party Assessment Organization (C3PAO)?
• Under CMMC practice AC.L2-3.1.5, what must organizations implement?
• Under AC.L2-3.1.15, what is required to execute privileged commands?
• In CMMC, what is essential for an activity to be classified as a Practice?
• What kind of information must the OSC define for audit record content according to AU.L2-3.3.2?
• What does CMMC practice AT.L2‑3.2.3 require for mitigating insider threats?
• What is indicated by the CMMC Status when assessing an information system?
• What tool is used to help establish context for CMMC Assessment activities?
• What risk is associated with an insider threat?
• What is one of the main objectives of security policies within an organization?
• What components should maintenance documentation include according to CMMC Level 2 practices?
• What is essential for both parties in a Non-Disclosure Agreement (NDA)?
• What is a primary requirement under SI.L2-3.14.3 for organizations regarding security alerts?
• Which of the following is NOT a characteristic of an External Service Provider?
• What is the function of Information Assurance (IA) in the context of a DMZ?
• How are logical locations defined within an information system?
• In terms of asset protection, what does the CMMC Level 2 practice necessitate?
• What is a System Security Plan (SSP)?
• What does the Commercial and Government Entity (CAGE) Code signify in the CMMC assessment process?
• What must tests or demonstrations pass to be considered acceptable evidence?
• Which component does a Network Diagram typically include?
• What describes the ideal implementation of privileged functions according to CMMC?
• What is the purpose of a Shared Responsibility Matrix (SRM)?
• What is the role of a Lead CCA during an assessment?
• What type of assets are classified as Specialized Assets?
• What is the purpose of the Separation of Duties principle in CMMC?
• Which of the following best describes a Procedure in CMMC?
• What role does the Quality Assurance Individual play during the CMMC assessment?
• What is characterized by the traditional IT infrastructure within a professional environment?
• What is included in the effective incident handling process defined by IR.L2-3.6.1?
• What must a legal notification inform users regarding information system usage?
• What is a key requirement of remote access under CMMC practice AC.L2-3.1.12?
• Under MA.L2-3.7.2, what is the focus of CMMC practice regarding system maintenance?
• Why is timely repair and maintenance of systems essential for organizations?
• What characterizes out-of-scope assets in CMMC assessments?
• What is the main purpose of a CUI Enclave?
• What type of approach is recommended for maintenance activities to avoid risks?
• What is the purpose of the report prepared following a CMMC assessment?
• Which factor is NOT considered when testing incident response capabilities?
• What role does the Affirming Official play in an organization?
• What does an organizational chart represent in a company?
• What does a Computer Security Incident Response Team (CSIRT) do?
• In the context of CMMC, what primarily defines 'logical access'?
• Contractor Risk Managed Assets (CRMA) must be documented in all of the following EXCEPT:
• Which of the following best describes the significance of strategic goals in a CMMC Plan?
• According to the assessment objectives of CMMC practice AC.L2-3.1.3, what must be defined?
• What is the primary focus of CMMC Level 2 practices regarding organizational systems?
• What is the role of the Cyber AB in the CMMC assessment process?
• Security Protection Assets (SPAs) primarily provide what function?
• What should assessors determine for remote access routing according to AC.L2-3.1.14?
• What is a key requirement of the role-based security training outlined in AT.L2-3.2.2?
• In the context of industrial environments, what does the Purdue Model help establish?
• What does CMMC requirement AC.L2-3.1.13 mandate for OSCs regarding remote access sessions?
• What does CUI stand for?
• How do organizations reinforce risk-aware behavior as stated in AT.L2-3.2.1?
• What key issue must be addressed during the In-Brief Meeting for assessment preparation?
• What is the primary purpose of limiting the use of portable storage devices on external systems according to CMMC practice?
• What should interviews conducted during an assessment demonstrate?
• What is the purpose of an Asset Inventory?
• What must assessors determine regarding users and nonsecurity functions according to AC.L2-3.1.6?
• What is the main purpose of a C3PAO being listed as "authorized" or "accredited" in the CMMC Marketplace?
• What is the primary requirement for CUI Assets within CMMC?
• What must an organization define regarding session termination conditions?
• What must organizations ensure when scheduling maintenance activities?
• What does "eMASS" refer to in the CMMC context?
• What is the goal of the testing mandated by IR.L2-3.6.3?
• What types of devices qualify as mobile devices?
• What is the required length of the Artifact Retention Period for CMMC assessment artifacts?
• What does the term “facility” refer to in the context of enabling actions?
• Which action is part of the Process in CMMC?
• What does the term "Organization Seeking Assessment (OSA)" refer to?
• What are participants in Level 2 certification assessments called?
• Which document outlines the CMMC Security Requirements Level 2?
• Which term refers to the scope of the system and environment being assessed?
• What does security control inheritance refer to?
• Which term describes the location defined by software and network configurations, such as VLANs?
• What is the purpose of the FedRAMP Moderate Equivalency documentation?
• Which of the following is NOT a requirement for assets classified under CRMA?
• Subnetworks in a network architecture are primarily used for what purpose?
• Which approach is NOT a part of reinforcing risk-aware behavior according to CMMC?
• What requirement does AT.L2-3.2.1 emphasize for users of organizational systems?
• What are Security Boundary Constraints?
• Which organization produces the CMMC doctrine that guides assessment procedures?
• What common limitation might Specialized Assets face?
• What does the CMMC Assessment Scope refer to?
• Which of the following best describes "Information Flow Control" in the context of OSC?
• What is classified as test equipment in a CMMC context?
• What allows VLANs to manage data flow and enhance security?
• What is the purpose of VPN gateways in a network?
• What does the use of session locks ensure regarding visible information?
• What approach should organizations take when performing maintenance activities?
• What is the significance of having a Certificate of CMMC Status?
• What does a mobile device need regarding data storage?
• What characterizes Physical Separation in asset management?
• What type of evidence is necessary to demonstrate compliance with FedRAMP Moderate standards?
• Which practice limits system access to authorized users and devices?
• What is necessary when confirming compliance for mobile encryption according to AC.L2-3.1.19?
• What action does session termination entail?
• What is a fundamental practice for maintaining organizational systems?
• What is a key component of maintenance activities according to the CMMC requirements?
• What is the role of the organization in relation to a contract?
• What is the primary purpose of physical or logical separation of assets that process CUI?
• What does "security relevant information" refer to?
• Which of the following account types does NOT categorize access privileges?
• What is the primary purpose of a Security Control Assessment?
• What is the primary goal of an Assessment in the CMMC context?
• According to AC.L2-3.1.18, what is required for mobile device connections in OSCs?
• What is the purpose of evidence validation in CMMC assessments?
• What does the Lead CCA need to explain during the In-Brief Meeting?
• What is a Practice in the context of CMMC objectives?
• How are security policies typically structured in terms of content?
• According to IR.L2-3.6.2, how should organizations manage security incidents?
• During an assessment, what is the purpose of inviting questions from the OSC in the In-Brief Meeting?
• What does the document detailing Procedures need to provide?
• Which situation would indicate a too-broad scope for a CMMC assessment?
• What is a key requirement of the practice concerning the flow of Controlled Unclassified Information (CUI)?
• Who initiates the certification engagement for a CMMC assessment?
• What defines connected systems in relation to FCI/CUI environments?
• What is a key focus during Phase 4 of the CMMC Assessment Process?
• What is the purpose of a session lock?
• Why is regular security awareness training necessary?
• Which of the following describes Security Protection Data (SPD)?
• What element is necessary to include in audit logs to meet CMMC system auditing requirements?
• What does a governing policy artifact for CMMC include?
• Which of the following best describes 'Incident Handling'?
• According to CMMC practice AC.L2-3.1.5, what is required for privileged accounts?
• Who conducts the Certification Assessment in a CMMC context?
• What defines an organization's environment according to the Network Diagram?
• Which assessment activity is overseen by the Quality Assurance Individual?
• Which of the following components would NOT be considered part of a baseline configuration?
• Which artifact is produced by the hashing tool in the CMMC process?
• Why is it essential to maintain baseline configurations?
• Which of the following actions is essential according to the control SI.L1-3.14.4 for organizations to combat malware?
• Which of the following best describes Acquisitions in the context of federal government?
• What does AC.L2-3.1.19 require for all CUI on mobile devices?
• Which component in CMMC assessments ensures compliance with cybersecurity practices?
• What does a Data Flow Diagram illustrate?
• Which of the following best describes the Internet of Things (IoT)?
• What aspect does the Shared Responsibility Matrix aim to clarify?
• What does SI.L2-3.14.1 require organizations to do regarding system flaws?
• What does the CMMC requirement for system baselining aim to ensure?
• What are artifacts in the context of CMMC assessments?
• What does Evidence Acceptability refer to in CMMC assessments?
• What type of technologies do boundary control devices include?
• In CMMC 2.0, why are physical access controls essential at physical locations?
• What is the purpose of regular updates to malicious code protections described in SI.L1-3.14.4?
• What does the System Security Plan outline regarding security controls?
• What is the main benefit of encrypted remote access?
• What is the purpose of the CMMC Hashing Tool Execution Policy?
• What characterizes a virtual assessment in the CMMC process?
• What does a Government Furnished Equipment (GFE) asset include?
• What aspect should assessors verify regarding the generated audit records according to AU.L2-3.3.1?
• What is included in a Service Level Agreement (SLA)?
• Security Protection Assets (SPA) are primarily used for what purpose?
• What is described as a security design principle allowing only the necessary system access?
• Which of the following best defines an incident in the CMMC context?
• What do Restricted Information Systems support?
• Who is responsible for affirming compliance with CMMC Program requirements within an Organization Seeking Assessment?
• What document confirms the compliance status and results of a CMMC assessment?
• What describes a Privileged Command as per CMMC?
• What must organizations do associated with wireless access as indicated by AC.L2-3.1.16?
• What type of data would typically fall under the category of Security Protection Data (SPD)?
• Which of the following systems is not typically categorized as Operational Technology?
• What is a key aspect of the CMMC Level 2 practice for System Auditing per AU.L2-3.3.1?
• What defines a portable storage device?
• According to AU.L2-3.3.2, what must be uniquely traced for accountability?
• What characteristic describes emergency accounts?
• What does the term "one-way function" refer to in the context of SHA-256?
• What does a Plan in CMMC encompass?
• What does the principle of least privilege ensure for security functions and accounts?
• What is the significance of monitoring maintenance and repairs?
• What governs the types of services outlined in a Service Level Agreement?
• How should reviews of maintenance activities be conducted according to CMMC standards?
• What type of output does the SHA-256 algorithm produce from input data?
• What does effective identification of wireless access points help to prevent?
• Which characteristic best defines a Demilitarized Zone (DMZ)?
• What is the goal of the Non-Duplication assessment planning step?
• What is prohibited in terms of information system use according to legal notifications?
• How are portable storage devices defined in the context of information systems?
• What is a key benefit of non-duplication in CMMC assessments?
• How is an asset defined in relation to CMMC compliance?
• When developing maintenance policies, what should organizations prioritize?
• What does the term External Service Provider (ESP) refer to?
• What does the practice AC.L2-3.1.8 require organizations to define in relation to logon attempts?
• What does an assessment objective express in a CMMC context?
• Which of the following best describes a physical location in system architecture?
• Which method of authentication is described as insecure within AC.L2-3.1.17?
• What action should organizations take regarding remote access information?
• What is required for documentation of Specialized Assets?
• What comprises a baseline configuration according to CMMC standards?
• What does the CMMCAssessmentLogHash.log file contain?
• Which aspect of the SHA-256 algorithm makes it suitable for integrity verification?
• What activities are involved in Phase 3 of the CMMC Assessment Process?
• Who reviews the appeals submitted within the CMMC assessment appeals process?
• What does equipment sanitization aim to achieve?
• What is the primary role of a Firewall in networking?
• What is a Virtual Local Area Network (VLAN) primarily used for?
• What must system-use notification banners display according to CMMC practice AC.L2-3.1.9?
• What must assessors confirm about wireless access according to CMMC practice AC.L2-3.1.17?
• What is the primary objective of the scoping process in CMMC compliance?
• What happens after all evaluations and evidence examinations are completed in a CMMC assessment?
• Which of the following represents a network device that requires isolation from internal systems when providing remote access?
• What is a fundamental requirement for a CMMC Level 2 certification assessment to proceed?
• What defines a contractor in the context of a contract with the DoD?
• What is required for an artifact to be considered acceptable evidence in a CMMC assessment?
• Which type of controls are used to manage data flow within interconnected systems?
• What function does access control policies serve?
• What is an observation in the context of a CMMC assessment?
• What must assessors verify regarding security roles according to AT.L2-3.2.2?
• What is the consequence of failing to enforce system security policy?
• What is the function of a RADIUS server in accessing wireless networks?
• What encryption method is utilized in WPA2-PSK?
• What does SI.L2-3.14.5 emphasize about scanning systems and files?
• What distinguishes Organizations Seeking Certification (OSC) from Organizations Seeking Assessment (OSA)?
• Under SI.L2-3.14.2, where must organizations provide malicious code protection?
• Within how many days must appeals concerning CMMC decisions be submitted?
• Which of the following is a responsibility of the organization’s security apparatus as outlined in CMMC?
• What is the purpose of the final written assessment results submitted by the assessment team?
• What is a critical measure to address when devices must be removed from the site for repair?
• What must the OSC enforce according to CMMC practice AC.L2-3.1.3 regarding separation of duties?