Discuss Cyber AB CMMC-CCA Exam Topic 1 Question 12

The team is assessing an OSC that uses the cloud for hosting its online services. Which of the following is NOT important for the assessor to consider?

ADevices connecting to the system are authorized.

BProcesses acting on behalf of a user are authenticated.

CUsers are authorized as a prerequisite to system access.

DFIPS encryption is authenticated as a prerequisite to system access.

Suggested Answer: D

Applicable Requirement: SC.L2-3.13.8 (Cryptographic protection of communications) and IA.L2-3.5.x (Identification and authentication).

Why D is Correct: Encryption must be validated as FIPS 140-2/3 compliant but is never ''authenticated as a prerequisite to access.'' Authentication applies to users, devices, and processes, not cryptographic modules themselves.

Why A, B, C are Correct Considerations:

Devices must be authorized before connecting.

Processes acting on behalf of a user must be authenticated.

Users must be authorized prior to access. These are all directly mapped to AC and IA domains.

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- IA and SC requirements

NIST SP 800-171A --- Assessment Objectives for AC/IA wireless and cloud access

CMMC Assessment Guide -- Level 2, Cloud/ESP Considerations

===========

Get Premium CMMC-CCA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

20 comments · newest first

Val 1 month ago

I’d say D is the right choice. Not all systems need FIPS.

Roslyn 1 month ago

C is definitely important, but D just seems excessive.

Tiera 2 months ago

B is also vital. Authentication is key for security.

Eulah 2 months ago

I feel like A is crucial. Unauthorized devices can cause major issues.

Tu 2 months ago

Agreed, D doesn't impact user access directly.

Stephaine 2 months ago

I think D is the least important. FIPS encryption isn't always necessary.

Rikki 2 months ago

I’m not so sure about that, D might still matter in some cases.

Colene 2 months ago

Totally agree with Alpha, D is the odd one out.

Kimberely 3 months ago

Wait, FIPS encryption isn't a prerequisite? That seems off.

Chun 3 months ago

I think all of them are important, especially A and C.

Alpha 3 months ago

D is definitely not important.

Allene 3 months ago

I'm not so sure about D being unimportant.

Leeann 3 months ago

Wait, FIPS encryption isn't always necessary?

Roselle 4 months ago

B and C are must-haves for sure!

Dexter 5 months ago

I think A is crucial, though.

Dylan 5 months ago

D is definitely not important.

Margart 6 months ago

I feel like D might be the odd one out here. We talked about encryption, but I don't recall it being a direct requirement for access like the others.

Keneth 6 months ago

This question reminds me of a practice exam where we had to identify what factors were essential for system security. I think B is definitely important.

Stefany 6 months ago

I'm a bit unsure about D. I know FIPS encryption is important, but I'm not sure if it's a prerequisite for access.

Royal 6 months ago

I remember discussing the importance of user authorization, so I think options A and C are definitely crucial.

Cyber AB CMMC-CCA Exam - Topic 1 Question 12 Discussion