Cyber AB CMMC-CCA Exam - Topic 1 Question 9 Discussion

Actual exam question for Cyber AB's CMMC-CCA exam

Question #: 9
Topic #: 1

You are a CCA participating in an assessment exercise for an OSC. You have completed the exercise, and the OSC has hashed the evidence artifacts in accordance with the CMMC Artifact Hashing Tool User Guide. What is the next step for your Assessment Team with respect to the Evidence Artifact Hashes?

ATell the OSC to encrypt the hash.

BUpload the Hashes to the OSC's CMMC eMASS.

CUpload them to your C3PAO's cloud instance.

DNothing, the assessment is complete.

Show Suggested Answer

Suggested Answer: B

Comprehensive and Detailed in Depth

The CAP requires the C3PAO to report OSC hashes to CMMC eMASS after hashing, not encrypting (Option A), using a C3PAO cloud (Option C), or doing nothing (Option D). Option B is correct.

Extract from Official Document (CAP v1.0):

Section 3.5 -- Archive Assessment Artifacts (pg. 36):'Once hashed, the C3PAO shall report the OSC's hash values in the CMMC eMASS System.'

CMMC Assessment Process (CAP) v1.0, Section 3.5.

by Sommer at Jan 05, 2026, 05:16 AM

Limited Time Offer

25%

Off

Get Premium CMMC-CCA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Mickie

3 days ago

A) Tell the OSC to encrypt the hash. Gotta keep that data secure, you know?

upvoted 0 times

...

Lucia

8 days ago

D) Nothing, the assessment is complete. Why would we need to do anything else with the hashes?

upvoted 0 times

...

Quentin

13 days ago

B) Upload the Hashes to the OSC's CMMC eMASS. That's the logical next step after hashing the evidence artifacts.

upvoted 0 times

...

Clemencia

18 days ago

Honestly, I’m leaning towards doing nothing since the assessment is complete, but that seems too simple.

upvoted 0 times

...

Lettie

24 days ago

I feel like the next step is to upload the hashes to the OSC's CMMC eMASS, but I could be mixing it up with another process.

upvoted 0 times

...

Raylene

29 days ago

I remember a practice question about this, and I think we just tell the OSC to encrypt the hash, right?

upvoted 0 times

...

Linwood

1 month ago

I think we might need to upload the hashes to the C3PAO's cloud instance, but I'm not completely sure.

upvoted 0 times

...

Lucina

1 month ago

I'm leaning towards option B as well. Uploading the hashes to the OSC's eMASS system seems like the appropriate next step after they've completed the hashing process.

upvoted 0 times

...

Deeanna

1 month ago

I feel pretty confident on this one. Since the OSC has already hashed the artifacts, the next logical step is to upload those hashes to the OSC's CMMC eMASS system, which is option B.

upvoted 0 times

...

Elliott

2 months ago

Okay, let me think this through. The options mention uploading the hashes somewhere, so I'm thinking B or C might be the right answer. But I'm not sure which one is the correct next step.

upvoted 0 times

...

Jamal

2 months ago

Hmm, I think the key here is that the OSC has already hashed the evidence artifacts. So I'm guessing the next step is to do something with those hashes, not the original artifacts.

upvoted 0 times

...

Trevor

2 months ago

I'm a bit confused by this question. Do we need to do something with the hashes, or is the assessment just complete?

upvoted 0 times

...