Cyber AB CMMC-CCA Exam - Topic 4 Question 8 Discussion

Actual exam question for Cyber AB's CMMC-CCA exam

Question #: 8
Topic #: 4

During a CMMC assessment, a CCA took home some documents from the OSC's facility without their knowledge. The documents contained confidential, proprietary information (jet engine designs). After a few days, the OSC realized the documents were missing. Upon realizing the mistake, the CCA returned the document and informed the Lead Assessor. One year later, the information appeared online. The OSC believes the CCA duplicated the information and kept a copy for themselves. Angered by the situation, the OSC sues the CCA for IP theft. Under the CoPC, what action should the CCA take?

APlead guilty to receive a reduced fine.

BNone; they should only defend themselves in court.

CInform the Cyber AB within 30 days.

DAsk their C3PAO for legal assistance.

Show Suggested Answer

Suggested Answer: C

Comprehensive and Detailed in Depth

The CoPC requires CCAs to report legal actions like lawsuits related to their CMMC role to the Cyber AB within 30 days, ensuring transparency and accountability. Option A (pleading guilty) is a legal strategy, not a CoPC requirement. Option B (doing nothing) ignores reporting obligations. Option D (asking C3PAO) is not mandated by CoPC. Option C is the required action.

Extract from Official Document (CoPC):

Paragraph 3.6(4) -- Lawful and Ethical Practices (pg. 8):'Report to the Cyber AB within 30 days any legal actions, such as being sued for larceny, related to your role in the CMMC ecosystem.'

CMMC Code of Professional Conduct, Paragraph 3.6(4).

by Keva at Nov 22, 2025, 05:51 AM

Limited Time Offer

25%

Off

Get Premium CMMC-CCA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Loren

10 hours ago

I disagree, they should just defend themselves in court.

upvoted 0 times

...

Carlton

6 days ago

CCA took home confidential docs? That's a big no-no.

upvoted 0 times

...

Alexis

11 days ago

Haha, the CCA is in deep trouble! They should have known better than to take those documents.

upvoted 0 times

...

Virgilio

16 days ago

A) Plead guilty to receive a reduced fine. Might as well get it over with.

upvoted 0 times

...

Paris

21 days ago

B) None; they should only defend themselves in court. Admitting anything would be a big mistake.

upvoted 0 times

...

Han

26 days ago

D) Ask their C3PAO for legal assistance. They'll need all the help they can get.

upvoted 0 times

...

Pearlie

1 month ago

C) Inform the Cyber AB within 30 days. That's the right thing to do.

upvoted 0 times

...

Janna

1 month ago

I’m confused about whether they should just defend themselves or inform the Cyber AB. I guess it depends on the specifics of the CoPC.

upvoted 0 times

...

Tamekia

1 month ago

This scenario reminds me of a practice question we had about legal responsibilities. I think they should definitely seek legal assistance, so maybe option D?

upvoted 0 times

...

Ty

2 months ago

I'm not entirely sure, but I feel like pleading guilty could lead to worse consequences in the long run.

upvoted 0 times

...

Sang

2 months ago

This is a tough one, but I think the CCA should inform the Cyber AB within 30 days. That seems like the most responsible and ethical thing to do, even though it might not be the easiest path. Gotta stick to the rules, you know?

upvoted 0 times

...

Crista

2 months ago

I'm feeling a bit confused about this one. There are a lot of factors to consider, and I'm not sure which option would be the best course of action. I think I'd need to do some more research before deciding.

upvoted 0 times

...

Fletcher

2 months ago

Okay, let's think this through. The CCA made a mistake, but it seems like they tried to correct it. Informing the Cyber AB within 30 days seems like the right thing to do, but I'd want to double-check the CoPC to be sure.

upvoted 0 times

...

Yuonne

2 months ago

I remember discussing the importance of reporting incidents to the Cyber AB, so I think option C might be the right choice.

upvoted 0 times

...

Kathrine

3 months ago

I agree, option C seems right. Transparency is key here.

upvoted 0 times

...

Jacquline

3 months ago

Definitely should inform Cyber AB ASAP!

upvoted 0 times

...

Kristeen

3 months ago

Yikes, this sounds like a really sticky situation. I'm not sure what the best approach would be, but I'd definitely want to get legal advice before deciding how to proceed.

upvoted 0 times

...

Phyliss

3 months ago

Hmm, this is a tricky one. I'd want to carefully review the Code of Professional Conduct to see what the proper protocol is in this situation.

upvoted 0 times

Ryann

2 months ago

I think the CCA should definitely inform the Cyber AB.

upvoted 0 times

...