Cyber AB CMMC-CCA Exam - Topic 1 Question 12 Discussion

Applicable Requirement: SC.L2-3.13.8 (Cryptographic protection of communications) and IA.L2-3.5.x (Identification and authentication).

Why D is Correct: Encryption must be validated as FIPS 140-2/3 compliant but is never ''authenticated as a prerequisite to access.'' Authentication applies to users, devices, and processes, not cryptographic modules themselves.

Why A, B, C are Correct Considerations:

Devices must be authorized before connecting.

Processes acting on behalf of a user must be authenticated.

Users must be authorized prior to access. These are all directly mapped to AC and IA domains.

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- IA and SC requirements

NIST SP 800-171A --- Assessment Objectives for AC/IA wireless and cloud access

CMMC Assessment Guide -- Level 2, Cloud/ESP Considerations

===========