Cyber AB CMMC-CCA 問題集

質問 1：
While completing the Level 2 Assessment, the Lead Assessor found that the OSC was deficient on a number of CMMC practices. Forty practices were scored as NOT MET, all on the Authorized Deficiency Corrections list. The OSC remediated 17 of those during closeout, leaving 23 practices still NOT MET. What should the Lead Assessor recommend?
A. Recommend an interim certification and put the 23 remaining practices on a POA&M
B. Fail the OSC and require them to remediate and reapply for Level 2 certification
C. Pass the OSC but put the 23 remaining on a POA&M
D. Recommend an interim certification and revisit the failed practices upon certification renewal
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A company mirrors its FCI/CUI data storage in a cloud environment. Data is managed across multiple virtual machines (VMs). To satisfy requirements for data security of the LOCAL copy using physical controls, what should the OSC do?
A. Use encrypted transport and storage of FCI/CUI data on the VMs.
B. Store FCI/CUI data without encryption for faster access/backup/restore.
C. Ensure that the VMs are running on hardware that is physically located in a controlled-access facility.
D. In addition to a password or personal identification number, use physical means to log in such as a smart card or hard token.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
The Assessment Team is meeting with the OSC team and experiences a situation where some members of the OSC team describe the IT infrastructure differently from others. In some discussions, one person identifies a series of ESPs, while another describes the infrastructure as on-premises. What should the Lead Assessor do to clarify the actual operational environment?
A. Review the network diagrams
B. Ask for the contact information of the identified ESPs
C. Interview an authoritative OSC representative
D. Review the system interconnection agreements
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 4：
The OSC POC has supplied all of the procedures, policies, and plans at the start of the assessment. One of the assessors notes that some of the documents have very recent approval dates, while others have been in place for several years based on the document history.
In order to ensure the review of this evidence is sufficient, what is the BEST step to validate the sufficiency of these documents?
A. Examine if the procedure in question replaced another document.
B. Examine the documents to determine if they are complete.
C. Interview people who hold leadership roles named in the documents.
D. Interview OSC team members who should be using the procedure.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 5：
During an assessment, the OSC IT security team provided documentation on how they use replay-resistant authentication to protect CUI. What can be used as a replay-resistant mechanism?
A. Biometric techniques
B. Requiring Transport Layer Security (TLS)
C. MFA devices to protect access for local users
D. Encrypted messages
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
An OSC is a wholly owned subsidiary of a large conglomerate (parent organization). The OSC and the parent organization use ID badges (PKI cards) that contain a PKI certificate and a radio frequency identification (RFID) tag used for building and system access (including systems that process, transmit, or store CUI). The parent organization does not make any decisions on how the OSC runs its security program or other matters of significance. The large conglomerate operates a machine that is used to activate the badges for both itself and the OSC. This machine is isolated in a locked room and has no network connectivity to the OSC.
The badge activation system is:
A. Out-of-scope because the OSC is the one that assigns the appropriate access to a particular PKI card.
B. In-scope because the parent organization acts as an External Service Provider to the OSC by providing PKI cards.
C. Out-of-scope because the badge activation machine is physically and logically isolated from the OSC and it is under the control of the parent organization.
D. In-scope because the OSC is part of the large conglomerate and thus any CMMC requirements of the OSC are imputed onto the large conglomerate.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 7：
To meet AC.L2-3.1.5: Least Privilege, the following procedure is established:
* All employees are given a basic (non-privileged) user account.
* System Administrators are given a separate System Administrator account.
* Database Administrators are given a separate Database Administrator account.
Which steps should be added to BEST meet all of the standards for least privilege?
A. 4. Database Administrators use the System Administrator accounts to perform privileged functions.
5. All other users use their basic account for all authorized functions.
B. 4. Database Administrators use the System Administrator accounts to perform privileged functions.
5. Non-privileged users use their basic account for all authorized functions.
C. 4. Database Administrators use their Database Administrator accounts to perform privileged functions.
5. All users use their basic account for non-privileged functions.
D. 4. Database Administrators use their Database Administrator accounts to perform privileged functions.
5. Non-privileged users use their basic account for non-privileged functions.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 8：
Different mechanisms can be used to protect information at rest. Which mechanism is MOST LIKELY to afford protection for information at rest?
A. File share
B. Patching
C. Secure offline storage
D. Cryptographic mechanisms
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 9：
An OSC is presenting evidence of its fulfillment of CM.L2-3.4.1: System Baselining. It provides:
* System inventory records showing additions/removals of machines,
* Software inventory showing installations/removals, and
* A system component installation plan with software needs and user specifications.
What other documentation MUST the company present to illustrate compliance with CM.L2-3.4.1?
A. Documentation of any authorized deviations from the system baselines for end-user computers
B. Documentation of a formal baseline review integrated with a system development lifecycle
C. Documentation of the physical safeguards protecting the "gold" baseline images
D. Documentation of a formal chain of custody for new hardware on which baselines will be installed
正解：A
解説: (Topexam メンバーにのみ表示されます)