CMMC-CCA Training & Certification Get Latest Cyber AB CMMC Updated on Oct 29, 2026 [Q71-Q86]

NO.71 A CCA is assessing the implementation of the Incident Reporting practice. To validate the control, what MUST the CCA ensure about the OSC?

NO.72 When assessing a contractor’s implementation of CMMC practices, you examine its System Security Plan (SSP) to identify its documented measures for audit reduction and reporting. They have a dedicated section in their SSP addressing the Audit and Accountability requirements. You proceed to interview their information security personnel, who informed you that the contractor has a dedicated Security Operations Center (SOC) and uses Splunk to reduce and report audit logs. How would you score the contractor’s implementation of AU.
L2-3.3.6 – Reduction & Reporting?

NO.73 An OSC has a minimal physical footprint consisting only of network equipment, workstations, and a centralized domain environment. File storage is centralized in a third-party vendor’s FedRAMP Moderate authorized cloud environment, and employees access files using the cloud integration with their workstations. Since CUI is stored in the FedRAMP Moderate authorized environment, the OSC should prepare to have which environment(s) assessed?

NO.74 While examining evidence, a CCA is trying to confirm the claim that the OSC has identified all information system users, processes acting on behalf of users, and all devices.
Which of the following provides the STRONGEST evidence of this practice?

NO.75 A Lead Assessor is conducting an assessment for an OSC. The OSC is currently using doors and badge access to limit access to private areas of their campus to only authorized personnel. Which item is another means of controlling physical access to areas that contain CUI?

NO.76 You are a CCA with an active and good standing on the Cyber AB Marketplace. An OSC has contracted your C3PAO for a prospective CMMC Assessment. The OSC provides signal processing services for the DoD.
You assisted the OSC in preparing for the upcoming CMMC assessment by conducting an initial evaluation of their implementation practices. With your background in cybersecurity and extensive experience, your C3PAO and Lead Assessor have selected you to join the Assessment Team. Based on this scenario, which of the following is the most important factor for the C3PAO to consider when assigning assessors to the Assessment Team?

NO.77 During an assessment, the Lead Assessor determines certain assets to be in-scope which the OSC had considered out-of-scope.
The CCA should reply that for assets to be considered out-of-scope they:

NO.78 To transfer CUI between a government client and its internal systems, a defense contractor uses a Secure File- Sharing Application provided by the DoD. However, all data traversing this boundary must pass through a next-generation firewall (NGFW) managed by the contractor’s Network Admin. All CUI is stored on a Solid State Drive (SSD) and accessed through a laptop. What type of asset is the Secure File-Sharing Application?

NO.79 An OSC is planning a CMMC Level 2 assessment that your C3PAO will conduct. In Phase 1.6.1 – Access and Verify Evidence, as the Lead Assessor, you are verifying the existence and accessibility of the evidence provided by the OSC. While reviewing the list of evidence mapped against the CMMC practices, you discover that the OSC cannot locate several critical system security policies for key IT systems supporting their DoD contracts. These missing policies are essential for demonstrating compliance with various CMMC practices related to access control, incident response, and system maintenance. According to the CMMC Assessment Process (CAP), which of the following is not permitted for the Lead Assessor to do during the evidence verification stage?

NO.80 Both FCI and CUI are stored by an OSC on the same network. Server A contains file shares with FCI, and Server B contains file shares with CUI. The OSC hopes each server would only undergo the assessment for the classification of data it contains. What is the MOST correct assessment situation in this scenario?

NO.81 You are the Lead Assessor of the Assessment Team conducting a CMMC Level 2 assessment for an OSC.
You have completed the first phase of the assessment process, which included the assessment kickoff meeting. Now, you are moving into the second phase, which involves collecting and examining evidence to determine the OSC’s compliance with the CMMC practices. Which of the following is not one of the recommended methods for collecting evidence during a CMMC assessment?

NO.82 During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on the OSC’s procedures around configuration management and endpoint security. The system administrator described how they build and deploy new systems, and noted that some users require specialized applications for their jobs. Users have been asked to email IT when they install and run an additional application so IT can add it to their list of allowed software.
What must the CCA conclude?

NO.83 After a security audit, a contractor documents specific vulnerabilities and deficiencies in an audit report. After examining its POA&M, you realize it has a clearly defined policy on addressing these deficiencies and by when. However, after interviewing the contractor’s security and compliance team, you learn that while an audit is regularly conducted, the remediating measures are not always taken, and when taken, they are not always practical. The security and compliance team informs you they have tried reaching the system administrator to explain the repercussions of this without success. What assessment objective has the contractor failed to implement from CMMC practice CA.L2-3.12.2 – Plan of Action?

NO.84 In an effort to understand whether the OSC appropriately defined the scope to exclude items that should not be assessed, which description does NOT belong in the scope?

NO.85 You are a CCA reviewing the security measures for a defense contractor seeking CMMC Level 2 compliance.
CMMC practice PE.L2-3.10.6 – Alternative Work Sites requires the organization to safeguard CUI at alternate work sites, like employee home offices. You are examining their list of safeguards and the system security plan to assess their compliance. When assessing a contractor’s implementation of CMMC practice PE.
L2-3.10.6 – Alternative Work Sites, which of the following would be the least effective method for gathering information?

NO.86 When interviewing a contractor’s CISO, they inform you that they have documented procedures addressing security assessment planning in their security assessment and authorization policy. The policy indicates that the contractor undergoes regular security audits and penetration testing to assess the posture of its security controls every ten months. The policy also states that after every four months, the contractor tests its incident response plan and regularly updates its monitoring tools. Impressed by the contractor’s policy implementation, you decide to chat with various personnel involved in security functionalities. You realize that although it is documented in the policy, the contractor has not audited their security systems in over two years. How many points would you score the contractor’s implementation of the practice CA.L2-3.12.1 – Security Control Assessment?