CMMC-CCA PDF Dumps 2025 Exam Questions with Practice Test [Q76-Q96]

QUESTION 76
Your C3PAO has selected you as the Lead Assessor for the Assessment Team assessing an OSC’s implementation of CMMC practices. Part of this assessment includes validating the OSC’s CMMC assessment scope. Which of the following is NOT a factor to consider when determining which assets are in scope?

Government assets transmitting CUI into the OSC’s systems.

Organizational assets that process CUI or FCI.

Assets that secure the CUI or FCI storage location.

Third-party assets that store CUI or FCI.

QUESTION 77
An OSC has a testing laboratory. The lab has several pieces of equipment, including a workstation that is used to analyze test information collected from the test equipment. All equipment is on the same VLAN that is part of the certification assessment. The OSC claims that the workstation is part of the test equipment (Specialized Asset) and only needs to be addressed under risk-based security policies. However, the OSC states that the data analysis output is CUI. What is the assessor’s BEST response?

Disagree with the OSC and include the workstation in the full assessment.

Disagree with the OSC and score practice CA.L2-3.12.4: System Security Plan as NOT MET.

Agree with the OSC but perform a limited check of the system, not increasing the assessment cost or duration.

Agree with the OSC and determine if it is managed using the contractor’s risk-based information security procedures and practices.

QUESTION 78
When preparing for an assessment, the assessor determines that the client’s proprietary data resides within an enclave. However, the assessor is unable to review policies containing proprietary data onsite and plans to have the policies copied on removable media by the client’s IT staff, whom they are scheduled to interview.
What should the assessor consider as part of their planning?

No proprietary data can leave the client’s environment under any circumstances.

The assessor can transmit data outside the client’s environment if the client’s IT support staff grants access.

No proprietary data can leave the client’s environment without the express written consent of the OSC POC.

No proprietary data can leave the client’s environment without the express written consent of the OSC Assessment Official.

QUESTION 79
An Assessment Team is reviewing the scope of a CMMC assessment for an OSC. The OSC has defined a narrow security boundary for their assessment, which the Assessment Team believes may not adequately protect all sensitive information. The OSC gives reasons for this, including financial constraints, and claims that CUI is only contained within an enclave defined by the boundary. However, after inspecting the facility and interviewing employees, you determine that some assets that may process CUI are outside the enclave.
What is the risk of the OSC defining a security boundary that is too narrow in scope for the CMMC assessment?

The OSC will have more systems that need to be managed separately.

The OSC may not have done proper due diligence to protect all sensitive information within their environment.

The assessment will be less expensive for the contractor.

The assessment will take less time to complete.

QUESTION 80
Implementation of and compliance with CMMC practices is not just a one-time effort but a sustained and habitual practice within the organization. As a CCA, you are part of an Assessment Team conducting a CMMC assessment for an OSC. As part of the assessment process, the CCA must confirm that the OSC has persistently implemented the CMMC policies and practices across all levels of the organization. To validate the persistent implementation of CMMC policies and practices, which of the following sources of evidence should you primarily focus on?

The OSC’s training programs and resource allocation for CMMC implementation

Interviews with personnel to gauge their awareness and understanding of CMMC practices

The OSC’s policy documents and executive-level communications

A combination of policies, plans, resourcing, communications, and training that are elements of the organization’s cybersecurity program

QUESTION 81
A company is seeking Level 2 CMMC certification. During the Limited Practice Deficiency Correction Evaluation, the Lead Assessor must decide whether the company can move to a POA&M review. Which condition will result in the Lead Assessor recommending that the OSC’s practice deficiencies move to a POA&M review?

A final score below 88

A final score of 110

A final score of 80 or better

A final score of 88/110 or better

QUESTION 82
You are assessing an organization’s implementation of the System and Information Integrity (SI) practices.
During your assessment, you find that the organization has subscribed to security alert and advisory services from reputable sources, such as US-CERT and relevant industry-specific organizations. In interviews with their network and system administrators, you learn that they have deployed an intrusion detection system (IDS) to monitor network traffic for known threats and suspicious activities. They also have a Security Information and Event Management (SIEM) system in place to aggregate and analyze logs from various sources for potential security incidents. Additionally, the network administrator informs you that they have established a Security Operations Center (SOC) to monitor and analyze activity on networks, servers, databases, applications, and other systems. However, you notice that while the organization receives these alerts and advisories, there is no documented process or assigned personnel responsible for reviewing and acting upon them. After reviewing the organization’s implementation, which of the following would be the most appropriate next step for the assessor to validate compliance with CMMC practice SI.L2-3.14.3 – Security Alerts & Advisories?

Test the organization’s processes for defining, receiving, and disseminating security alerts and advisories

Examine the organization’s system and information integrity policies and procedures

Review system audit logs and records for evidence of actions taken in response to security alerts and advisories

Interview the personnel responsible for the Security Operations Center (SOC) to determine whether they take actions in response to security alerts and advisories

QUESTION 83
After completing a CMMC assessment, the OSC should hash all the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide. However, you have just realized that this requirement was not fulfilled, and the OSC Assessment Official cannot be reached to confirm it was done. To avoid any issues, you quickly complete this step and later inform the OSC Assessment Official. Which CoPC principle have you just violated by hashing the evidence artifacts in place of the OSC?

Professionalism

Confidentiality

Objectivity

Information Integrity

QUESTION 84
An OSC plans to bid for a DoD contract to supply laser welding services to repair a fleet of unmanned aerial vehicles (UAVs). This requires them to be CMMC Level 2 certified since the information they will receive from the DoD is Controlled Technical Information (CTI). However, their repair and welding services require a Computer Numerical Control (CNC) machine to fabricate some crucial parts. Since the welding is mainly automated using robots, the OSC has intelligently integrated its SCADA system with Programmable Logic Controllers (PLCs) for increased accuracy, improved safety and efficiency, and enhanced flexibility. If the OSC wins the contract, how will the banner marking on documents containing CUI from the DoD be structured?

CUI//SP-CTI

CUI//CTI

CUI/SP-CTI

CUI-SP//CTI

QUESTION 85
An OSC is looking to bid for a contract to manufacture turboprop engines for an unmanned aerial vehicle (UAV) fleet used by the Army for long-range reconnaissance. To manage production, the OSC will use Industrial Control Systems (ICS) and has documented them in its Operational Technology (OT) inventory.
While validating the OSC’s proposed assessment scope, the Assessment Team reviews their SSP. How should the C3PAO Assessment Team handle the OSC’s OT during the assessment?

Accept the OSC’s documentation of policies and procedures as they are.

Assess them against CA.L2-3.12.3 – Security Control Monitoring.

Assess them against all CMMC practices.

Review the SSP and not assess the OT against other CMMC practices.

QUESTION 86
During a CMMC assessment, the OSC provides a service-level agreement (SLA) with an external provider as evidence for an inherited practice. The SLA outlines general security commitments but lacks specific details on how the practice’s objectives are met. How should the Lead Assessor proceed?

Accept the SLA as sufficient evidence since it shows a contractual obligation.

Request additional detailed evidence from the external provider to demonstrate compliance with the practice’s objectives.

Score the practice as “NOT MET” due to the lack of specific details.

Ask the OSC to renegotiate the SLA to include detailed compliance information.

QUESTION 87
You are assessing a contractor’s implementation for CMMC practice MA.L2-3.7.4 – Media Inspection by examining their maintenance records. You realize the maintenance logs identify a repeating problem. A recently installed central server has been experiencing issues affecting the performance of the contractor’s information systems. This is confirmed by your interview with the contractor’s IT team. You requested to investigate the server, and the IT team agreed. On the server, there is a file named conf.zip that gets your attention. You decide to open the file in an isolated computer for further review. To your surprise, the file is a .
exe used when testing the server for data exfiltration. How should this incident be handled?

By immediately reporting it to the FBI’s Cyber Division

Decommissioning the server and installing a new one

In accordance with the incident response plan

By sandboxing the malicious code and continuing with business as usual

QUESTION 88
An OSC previously received a Conditional CMMC Level 2 Certification during Phase 3 of the assessment process. The OSC has been working on implementing a POA&M to address the practice deficiencies identified during the initial assessment. Now, within 180 days from the Final Recommended Findings Briefing, you are to conduct a POA&M Closeout Assessment. As the Lead Assessor, you and your assessment team review the OSC’s updated POA&M, accompanying evidence, and any scheduled observations, interviews, or tests with the aim of validating the implementation of the corrective actions. If the Organization Seeking Certification (OSC) disagrees with the C3PAO’s findings during the POA&M Closeout Assessment, what is the recourse?

Immediately reapply for CMMC Level 2 certification with a different C3PAO.

Submit an appeal using the Assessment Appeals Process outlined in the CAP.

Request an extension of the timeline for corrective actions.

Demand a reassessment by the same C3PAO and Lead Assessor.

QUESTION 89
An OSC is planning to have a C3PAO perform a CMMC Level 2 assessment. When validating the OSC’s proposed assessment scope, you realize they use an ESP for various cybersecurity services. What action must you, as a CCA, take regarding the ESP?

Confirm the ESP has a CMMC Level 2 or Level 3 certification.

Accept the OSC’s inclusion of the ESP in their assessment scope.

Advise the OSC to choose another ESP.

Request a self-assessment from the ESP.

QUESTION 90
A company describes its organization as having two systems. One system, System Org, covers the entire organization and allows instant messaging, email, and Internet activity. The other system, System CUI, is used for processing, storing, and transmitting CUI data. System CUI interfaces with System Org through security mechanisms and a firewall.
The CMMC Assessment is being done on System CUI only.
What is the BEST way to describe System CUI?

CUI Assets

In-Scope Assets

Out-of-Scope Assets

CUI Assets and Security Protection Assets

QUESTION 91
While reviewing CA.L2-3.12.3: Security Control Monitoring, the CCA notices that the assessment period is defined as one year. An OSC’s SSP states that under CA.L2-3.12.3, security controls are monitored using the same one-year periodicity to ensure the continued effectiveness of the controls. The assessor understands that some CMMC practices can reference other practices for the entirety of their implementation. Is the OSC’s implementation under CA.L2-3.12.3: Security Control Monitoring acceptable?

No, even when referencing other practices more description is always needed.

No, monitoring must be conducted on an ongoing basis to ensure continued effectiveness.

Yes, a one-year period for security control monitoring is acceptable.

Yes, as long as CA.L2-3.12.1 has been scored as MET, they do need to be monitored.

QUESTION 92
While implementation validation of most CMMC requirements can be done virtually, the CMMC Assessment Process (CAP) identifies 15 CMMC practice objectives whose implementation must be observed by the Assessment Team in person and on the premises of the OSC. PE.L2-3.10.2 [c] and [d] are among these objectives. Both assessment objectives deal with monitoring the OSC’s physical facilities and support infrastructure. Which assessment procedure or method can a CCA use to determine how well the OSC has implemented PE.L2-3.10.2 [c] and [d]?

Interview personnel with information security responsibilities

Test the OSC’s Incident Response Plan

Examine the System Security Plan

Test or examine mechanisms supporting or implementing physical access monitoring

QUESTION 93
During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on the OSC’s procedures around configuration management and endpoint security. The system administrator described how they build and deploy new systems, and noted that some users require specialized applications for their jobs. Users have been asked to email IT when they install and run an additional application so IT can add it to their list of allowed software.
What must the CCA conclude?

The OSC has not properly implemented application allow listing.

IT must deploy an application to report newly installed software.

The OSC has properly implemented application deny listing.

IT does not have a policy that users notify IT when they install new applications.

QUESTION 94
A CCA is assessing the concept of least functionality in accordance with CM.L2-3.4.6: Least Functionality.
Which method is the LEAST LIKELY to be useful as an assessment technique?

Interview personnel with information security responsibilities.

Interview personnel with application development responsibilities.

Interview personnel who wrote the configuration management policy.

Interview personnel with security configuration management responsibilities.

QUESTION 95
An OSC submits to the C3PAO Assessment Team for validation a CMMC assessment scope that includes an enclave. During validation, you learn that while CUI is stored on a single physical server, authorized employees can access it through virtual instances, thanks to VMware. You also determine that the OSC has deployed a DFARS-compliant firewall to protect network connections to the enclave and a VLAN to restrict communication between different portions of the network. Which method can the OSC be said to have used to secure its enclave?

Physical separation

Segmentation

Decentralization

Virtualization

QUESTION 96
You were the Lead Assessor on a team that conducted a CMMC assessment for an OSC that passed and earned a CMMC L2 Certification. Meeting this requirement, the OSC bid on and won a DoD contract.
However, a rival company disputes the OSC’s CMMC certification status in court. As part of the evidence, the court has directed you to release the assessment results and any evidence you might have relied on to arrive at the assessment results. Based on the CoPC, what action should you take in this situation?

Release the assessment results only after obtaining written permission from the OSC being assessed.

Release the assessment results.

Do not release the assessment results under any circumstances.

Release only a summary of the assessment results.