CMMC-CCA Questions & Answers - Topic 3 - Assessing CMMC Level 2 Practices - Demo Version 4.0

Sep 26, 2026

Uploaded by Jake

Demo-style practice questions for the Certified CMMC Assessor (CCA) exam under CMMC Level 2 Topic 3, focusing on assessing controls for AC and AU requirements. Scenarios cover handling privileged functions through appropriate logging to central SIEM systems, evaluating whether unsuccessful logon attempt thresholds and lockout/reset parameters satisfy AC L2-3.1.8, and identifying an assessment approach for AU L2-3.3.1 when audit records have insufficient content and short retention.

LanguageEnglish

CategoryExam

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

Topic 3, Assessing CMMC Level 2 Practices

Question 1: AC. L2-3.1.7 – Privileged Functions

Question 2: AC. L2-3.1.8 – Unsuccessful Logon Attempts

Question 3: AU. L2-3.3.1 – System Auditing

Cyber AB CMMC-CCA Questions & Answers Certified CMMC Assessor (CCA) Exam (Demo Version-Limited Content) Version: 4.0 Topic 3, Assessing CMMC Level 2 Practices Question: 1 You are assessing Conedge Ltd, a contractor that develops cryptographic algorithms for classified government networks. In reviewing their network architecture documents, you see they have implemented role-based access controls on their workstations using Active Directory group policies. Software developers are assigned to the "Dev_Roles" group which grants access to compile and test code modules. The "Admin_Roles" group with elevated privileges for system administration activities is restricted to the IT staff. However, when you examine the event logs on a developer workstation, you find evidence that a developer was able to enable debugging permissions to access protected kernel memory – a privileged function. How should execution of the debugging permission be handled to align with AC. L2-3 .1.7 – Privileged Functions? A. Require it to generate an email alert B. Perform automatic termination of the action C. Implement geo-IP blocking on the workstation D. Ensure it is logged to the central SIEM system Answer: D Explanation: Comprehensive and Detailed In-Depth Explanatio n: AC. L2-3.1.7 requires "preventing non-privileged users from executing privileged functions and logging such attempts." The developer’s access to kernel memory (a privileged function) violates least privilege, and logging to a SIEM (D) ensures visibility and auditability, aligning with the practice. Alerts (A) are supplementary, termination (B) isn’t required, and geo-IP blocking (C) is unrelated. The CMMC guide emphasizes logging for accountability. Extract from Official CMMC Documentation: CMMC Assessment Guide Level 2 (v2.0), AC. L2-3.1.7: "Log attempts by non-privileged users to execute privileged functions. " NIST SP 800-171A, 3 .1. 7: "Examine logs for privileged function attempts. " Resources: [https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)[ ](https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.0_FINAL_20211201)6_508. pdf Question: 2 While reviewing a contractor's Microsoft Active Directory authentication policies, you observe that the account lockout threshold is configured to allow 5 consecutive invalid login attempts before locking the account for 15 minutes. Additionally, the reset account lockout counter is set to 30 seconds after each unsuccessful login attempt. Based on this scenario, which of the following statements are TRUE about the contractor's implementation of CMMC practice AC. L2-3 .1.8 – Unsuccessful Logon Attempts? A. The contractor has successfully implemented practice AC. L2-3 .1.8 – Unsuccessful Logon Attempts warranting a score of MET B. The contractor's approach does not provide sufficient protection against unauthorized access attempts C. Based on the current implementation, CMMC practice AC. L2-3 .1.8 cannot be scored as MET D. The contractor's approach does not adequately address the required assessment objectives Answer: A Explanation: Comprehensive and Detailed In-Depth Explanatio n: AC. L2-3.1.8 requires "limiting unsuccessful logon attempts" by defining: [a] a threshold, and [b] a lockout duration or delay. The contractor’s settings (5 attempts, 15-minute lockout, 30-second reset) meet these objectives, providing reasonable protection against brute-force attacks. While stricter settings (e.g., fewer attempts) could enhance security, CMMC doesn’t mandate specific values, only that limits are enforced. This 1-point practice scores Met (+1), making A true. B, C, and D assume inadequacy without evidence of failure. Extract from Official CMMC Documentation: CMMC Assessment Guide Level 2 (v2.0), AC. L2-3.1.8: "Define and enforce [a] number of attem

FAQs

How should privileged function execution be handled to align with AC. L2-3.1.7?

Execution that grants access to privileged functions should be handled by logging attempts by non-privileged users to ensure auditability and visibility in a central SIEM system.

Why is the contractor’s configuration for lockout and reset considered MET for AC. L2-3.1.8?

Because it limits unsuccessful logon attempts using a defined threshold and lockout duration/delay (5 attempts, 15-minute lockout) and includes a reset counter after failures (30 seconds), meeting the practice’s assessment objectives.

Which assessment method best applies to AU. L2-3.3.1 when audit logs lack sufficient identifying content?

Examine procedures that address audit record generation to verify whether the defined content of audit records is sufficient to support monitoring, analysis, investigation, and reporting.

Sep 26, 2026

Uploaded by Jake