[Q83-Q106] Top Cyber AB CMMC-CCA Courses Online – Updated [Sep-2026]

NO.83 AC.L2-3.1.6: Non-Privileged Account Use is being assessed. Which procedure BEST meets all of the standards for non-privileged account use?

NO.84 While implementation validation of most CMMC requirements can be done virtually, the CMMC Assessment Process (CAP) identifies 15 CMMC practice objectives whose implementation must be observed by the Assessment Team in person and on the premises of the OSC. PE.L2-3.10.2 [c] and [d] are among these objectives. Both assessment objectives deal with monitoring the OSC’s physical facilities and support infrastructure. Which assessment procedure or method can a CCA use to determine how well the OSC has implemented PE.L2-3.10.2 [c] and [d]?

NO.85 You are assessing an organization’s implementation of the System and Information Integrity (SI) practices.
During your assessment, you find that the organization has subscribed to security alert and advisory services from reputable sources, such as US-CERT and relevant industry-specific organizations. In interviews with their network and system administrators, you learn that they have deployed an intrusion detection system (IDS) to monitor network traffic for known threats and suspicious activities. They also have a Security Information and Event Management (SIEM) system in place to aggregate and analyze logs from various sources for potential security incidents. Additionally, the network administrator informs you that they have established a Security Operations Center (SOC) to monitor and analyze activity on networks, servers, databases, applications, and other systems. However, you notice that while the organization receives these alerts and advisories, there is no documented process or assigned personnel responsible for reviewing and acting upon them. After reviewing the organization’s implementation, which of the following would be the most appropriate next step for the assessor to validate compliance with CMMC practice SI.L2-3.14.3 – Security Alerts & Advisories?

NO.86 You are assessing a contractor that develops software for air traffic control systems. In reviewing their documentation, you find that a single engineer is responsible for designing new ATC system features, coding the software updates, testing the changes on the development network, and deploying the updates to the production ATC system for customer delivery. How will proper separation of duties help the contractor meet the intent of AC.L2-3.1.4 – Separation of Duties?

NO.87 During a CMMC Level 2 assessment, a CCA is evaluating whether the organization meets the requirement to
“Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.” According to the CMMC requirement, the CCA must determine whether FIPS-validated cryptography is employed to protect the confidentiality of CUI. Which assessment procedure would the CCA most likely use to evaluate this requirement?

NO.88 A contractor is preparing to bid on an upcoming DoD contract to provide next-generation upper limb prosthetics for injured servicemen. Part of the preparation is undergoing a CMMC assessment, and they have hired you to assess their implementation of CMMC practices. The contractor has multiple design, manufacturing, and supply chain management systems. Each system generates its audit logs, which are stored in separate repositories. Different teams analyze and review them independently, with each team reporting the findings to the respective departmental heads. For instance, the engineering team reviews and analyzes logs related to the design systems and reports to the lead engineer, while the operations team focuses on the manufacturing system logs. When interviewing personnel responsible for audit record review, analysis, and reporting, they inform you that this is deliberately set up to ensure departmental independence and granular risk identification. Based on the CMMC practice AU.L2-3.3.5 – Audit Correlation, what is the likely issue you would identify with the contractor’s current approach?

NO.89 A C3PAO and OSC have agreed to proceed with CMMC assessment planning. The OSC assessment official and the C3PAO are working to determine the planning details and purview of the Assessment, which includes scoping. When should the C3PAO and OSC conduct the high-level contract framing?

NO.90 You are the Lead Assessor for a C3PAO Assessment Team that has recently completed a CMMC Level 2 assessment for an OSC. You and your Assessment Team have finalized the assessment process and are now in Phase 3 – Report Recommended Assessment Results. You are preparing to deliver the final recommended findings to the OSC Assessment Official and OSC participants during the Final Findings Briefing. After you present the final recommended findings and practice scores, what is the next step in the CMMC Assessment Process?

NO.91 Assessing a DoD contractor, you observe they have implemented physical security measures to protect their facility housing organizational systems that process or store CUI. The facility has secure locks on all entrances, exits, and windows. Additionally, video surveillance cameras are installed at entry/exit points, and their feeds are monitored by security personnel. Feeds from areas where CUI is processed or stored and meeting rooms where executives meet to discuss things that have to do with CUI and other sensitive matters are segregated and stored on a designated server after monitoring. Walking around the facility, you notice network cables are hanging from the walls. To pass through a door, personnel must swipe their access cards.
However, you observe an employee holding the door for others to enter. Although power cables are placed in wiring closets, they aren’t locked, and the cabling conduits are damaged. Which of the following is NOT a concern regarding the contractor’s implementation of CMMC practice PE.L2-3.10.2 – Monitor Facility?

NO.92 You are the Lead Assessor for a CMMC Assessment engagement with an OSC for CMMC Level 2. The OSC has provided you with their proposed CMMC Assessment Scope, which includes a network schematic diagram, their SSP, relevant policies, and organizational charts. During your review of the documentation, you notice they have excluded a subsidiary company’s network and assets from the proposed CMMC Assessment Scope despite the subsidiary being involved in handling CUI related to federal contracts. If the OSC shares proprietary information with the Lead Assessor during the assessment engagement, what is the C3PAO’s responsibility regarding this information after the completion of the assessment?

NO.93 The Lead Assessor is compiling the assessment results, which must contain the status for each of the applicable practices. Some practices have been placed in the limited practice deficiency correction program.
Multiple areas have been reviewed, including HQ, host units, and a specific enclave.
In order to properly report the findings, the Lead Assessor MUST:

NO.94 Patrick’s company was hired to conduct a CMMC Level 2 assessment for Alto Technologies, where his aunt Jane is the VP of Marketing. Patrick did not disclose his relationship to Jane to his employer because he wanted to work on the Assessment Team and did not think Jane was aware of his job. Which of the following was the most appropriate course of action for Patrick?

NO.95 You are part of an Assessment Team tasked with conducting a CMMC Assessment for an OSC. When assessing the contractor’s implementation of SC.L2-3.13.6 – Network Communication by Exception, objectives [a] and [b], the OSC’s system admin informs you that they use Fortinet Next-Generation Firewall (NGFW). Fortinet NGFWs are hardcoded to deny all traffic by default, and traffic is only allowed on an exception basis. While this is factual, the Lead Assessor asks you to test the NGFW to ascertain whether it meets the intent of Assessment Objectives in SC.L2-3.13.6 – Network Communication by Exception. What is the benefit of testing as an assessment method?

NO.96 You are a CCA who is part of an Assessment Team conducting a CMMC assessment on an aerospace company. While analyzing their network architecture, you realize that it includes a Demilitarized Zone (DMZ) to host their public-facing web servers. What is the primary purpose of a DMZ in a network architecture?

NO.97 An OSC and a C3PAO Assessment Team are in the early stages of preparing for their CMMC assessment.
During the process of confirming the corporate identity for the assessment, the Assessment Team discovers that the OSC does not have a valid Commercial and Government Entity (CAGE) code issued by the Department of Defense. The team is now considering the implications of this finding and the next steps they should take. When confirming the corporate identity to be assessed, what can happen if you determine that the HQ organization doesn’t have a valid CAGE code?

NO.98 An OSC outsources all of its security incident and event monitoring work to a third-party SOC. Additionally, the OSC utilizes a cloud-hosted antivirus (AV) system to fulfill the requirement of having virus protection without hosting additional servers on-site.
During the scoping discussion, both the SOC and AV should be listed as what type of asset?

NO.99 The OSC prints out documents it receives via email that are marked as CUI. According to MP.L2-3.8.4:
Media Markings,
what should the Assessor expect to see on the printouts?

NO.100 The OSC implements security measures to control access to printers and manage printed documents. They use a pull-printing system that requires users to authenticate at a designatedprinter to release their print jobs.
These printers are installed in a printing press room where only authorized persons have access. To enter the room, individuals must scan their CAC cards. The room housing the printers can be considered what type of location?

NO.101 During a CMMC Level 2 Assessment, a CCA interviewed a system administrator on the OSC’s procedures around configuration management and endpoint security. The system administrator described how they build and deploy new systems, and noted that some users require specialized applications for their jobs. Users have been asked to email IT when they install and run an additional application so IT can add it to their list of allowed software.
What must the CCA conclude?

NO.102 An OSC is preparing for a CMMC assessment. It has multiple information systems, some of which process CUI and others that do not. The OSC has identified a specific system that processes CUI and defined this as its system boundary. However, this system is connected to other systems within the OSC that are separately authorized and do not process CUI. As a Certified CMMC Assessor, which of the following best describes your approach to defining the CMMC Certification Boundary and Assessment Scope for the OSC?

NO.103 A company is seeking Level 2 CMMC certification. During the Limited Practice Deficiency Correction Evaluation, the Lead Assessor must decide whether the company can move to a POA&M review. Which condition will result in the Lead Assessor recommending that the OSC’s practice deficiencies move to a POA&M review?

NO.104 The OSC POC has supplied all of the procedures, policies, and plans at the start of the assessment. One of the assessors notes that some of the documents have very recent approval dates, while others have been in place for several years based on the document history.
In order to ensure the review of this evidence is sufficient, what is the BEST step to validate the sufficiency of these documents?

NO.105 Before an OSC categorizes its assets into different categories, it must determine the scope of applicability.
However, after discussing with the OSC’s Point of Contact (PoC), you learn that although they follow CUI and FCI in all forms and stages, they are mostly considered technical components. What is the issue with the OSC’s approach to determining the scope of applicability?

NO.106 During the assessment of a company, the CCA learns that 50% of employees work from home using remote access. After reviewing the Access Control policy and audit logs, the CCA is unsure how the system ensures only employees with correct privileges can access CUI. The CCA decides a Test of functionality is required.
Which question is of the LEAST concern to the CCA?