Skip to main content
ITPrepCerts
Login
Exams Free Samples About Contact
Login Create an account

CMMC-CCA Certified CMMC Assessor (CCA) Exam

  • Cyber AB
  • 9 free sample questions

About this exam

CMMC-CCA is the Cyber AB exam Certified CMMC Assessor (CCA) Exam. Paid practice material for this exam is not available yet, but you can try its free sample questions.

Exam code
CMMC-CCA
Vendor
Cyber AB
Practice questions
Not available yet
Free sample questions
9
Question bank last updated
Not available yet

Try 2 sample questions

Taken from the free sample set for CMMC-CCA.

Question 1

An OSC has an established password policy. The OSC wants to improve its password protection security by implementing a single change .

Which of the following is an acceptable element to add to the OSC’s password policy?

  1. Option A:

    Require passwords to be changed every 18 months.

  2. Option B:

    Require passwords to be 5 to 7 characters long.

  3. Option C:

    Add the use of salted two-way cryptographic hashes of passwords.

  4. Option D:

    Add the use of salted one-way cryptographic hashes of passwords, where possible.

Show answer and explanation

Correct answer: D

The Identification and Authentication (IA) practices require that passwords be protected using strong methods. Storing passwords with salted one-way hashes ensures they cannot be reversed, providing strong protection.

Extract from IA.L2-3.5.10:

“Passwords must be stored and transmitted in a form that is resistant to compromise, typically using salted one-way cryptographic hashes.”

Options A and B do not align with modern password guidance, and option C (two-way cryptographic hashing) is insecure because it allows reversal.

[Reference: CMMC Assessment Guide – Level 2, IA.L2-3.5.10., ]

Question 2

During a CMMC Assessment, the assessor is determining if the Escort Visitors practice is MET.

Personnel with which of the following responsibilities would be MOST appropriate to interview?

  1. Option A:

    Repair and facilities maintenance

  2. Option B:

    Local access control and information security

  3. Option C:

    Physical access control and information security

  4. Option D:

    Information technology management and operations

Show answer and explanation

Correct answer: C

The Escort Visitors practice falls under Physical and Environmental Protection (PE.L2-3.10.3) , which requires organizations to escort visitors and monitor visitor activity .

To validate this, the assessor should interview personnel responsible for physical access control (security guards, facility access managers) and information security

(to confirm integration with CUI protection requirements).

Exact Extracts:

PE.L2-3.10.3: “Escort visitors and monitor visitor activity.”

Assessment Guide: “Interview personnel responsible for physical access control and security monitoring to confirm escort and visitor activity tracking.”

Assessment Objectives: Require evidence of visitor escorts, visitor logs, and monitoring practices.

Why the other options are not correct:

A (Repair/maintenance): Not responsible for escort procedures.

B (Local access control only): Missing the information security link , which ensures visitors cannot access CUI assets.

D (IT management): IT is not responsible for escorting visitors in physical spaces.

[References:, CMMC Assessment Guide – Level 2, Version 2.13: PE.L2-3.10.3 (pp. 154–156)., NIST SP 800-171A: Assessment procedures for visitor escort and monitoring., , , ]

See all 9 free sample questions