Cyber AB CMMC-CCA Exam Questions

When protecting backup data containing CUI, the requirement is to ensure confidentiality through logical or physical security controls appropriate to the sensitivity of CUI. Acceptable implementations include controlling access to CUI (AC family controls), physically securing media (MP family controls), and encrypting files or media (SC family controls). Merely implementing alternative physical controls for site access is insufficient because site access protections do not directly ensure the confidentiality of the backup media itself.

Exact Extracts (from official CMMC Assessor/Study documents and NIST SP 800-171A references):

SC.L2-3.13.16 (Encrypt CUI): ''Employ cryptographic mechanisms to prevent unauthorized disclosure of CUI during storage and transmission unless otherwise protected by alternative physical safeguards.''

MP.L2-3.8.9 (Protect backup CUI): ''Protect the confidentiality of backup CUI at storage locations.''

AC.L2-3.1.3 (Access enforcement): ''Limit access to CUI on the basis of need-to-know to protect confidentiality.''

Physical security references (PE family): ''Physical access controls provide general site protection but are not substitutes for encryption or media protection controls when CUI confidentiality is at risk.''

Why the other options are correct (acceptable methods):

B (Managing who has access to the information): Satisfies Access Control (AC) requirements that limit exposure of CUI only to authorized individuals.

C (Physically securing devices and media): Satisfies Media Protection (MP) requirements, ensuring CUI is stored securely and protected against unauthorized access.

D (Encrypting files or media): Directly satisfies System and Communications Protection (SC) requirements for confidentiality, a highly reliable method.

Why option A is least acceptable:

Alternative physical controls for site access protect buildings or rooms, but they do not directly safeguard backup media confidentiality. If backups are removed, lost, or accessed internally, site access controls alone cannot ensure confidentiality.

Reference (official CCA/CMMC documents):

CMMC Assessment Guide -- Level 2, Version 2.13: Practices SC.L2-3.13.16, MP.L2-3.8.9, AC.L2-3.1.3, and PE family discussion (pp. 93--96, 108--110, 125--127).

NIST SP 800-171A, Assessing Security Requirements for CUI: Related assessment objectives for protecting CUI backup confidentiality.

Applicable Requirement: AC.L2-3.1.12 and AC.L2-3.1.14 --- ''Monitor and control remote access sessions'' and ''Route remote access through managed access control points.''

Why A is Correct: For a single centralized access point, the most critical control is that remote access sessions are properly secured and monitored to prevent unauthorized access to CUI systems. This ensures both confidentiality and integrity of remote connections.

Why Other Options Are Insufficient:

B: Physical access controls protect on-site systems but do not address remote connection security.

C: Documentation alone is not sufficient; actual monitoring and security enforcement are required.

D: Notification procedures relate to incident handling, not adequacy of access point security.

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- AC.L2-3.1.12, AC.L2-3.1.14

NIST SP 800-171A --- Remote Access Assessment Objectives

CMMC Assessment Guide -- Level 2, Remote Access Guidance

The CMMC Assessment Process (CAP) specifies that when disputes cannot be resolved by the Lead Assessor, they must be elevated to the C3PAO Official, who has authority to make the final decision.

Extract:

''Unresolved disputes between the OSC and the Assessment Team must be elevated to the C3PAO Official for final resolution.''

Therefore, the C3PAO Official is the final arbiter in such disputes.

Applicable Requirement: PE.L2-3.10.1 --- ''Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.''

Why D is Correct: Documented procedures describing physical access restrictions (badge policies, visitor management, locked server rooms, guard post orders) serve as primary evidence that access is managed and enforced. Assessors can then corroborate via interviews and observation.

Why Other Options Are Insufficient:

A (VPN configuration): Relates to remote logical access, not physical security.

B (Switch configs): Technical network controls, not physical access.

C (Architecture drawings): Show logical/system design, not physical entry restrictions.

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- PE.L2-3.10.1

NIST SP 800-171A --- PE.L2-3.10.1 Assessment Objectives

CMMC Assessment Guide -- Level 2 --- Physical Protection Evidence Guidance

If an asset processes or generates CUI, it is a CUI Asset by definition, regardless of whether it is also part of a test lab or claimed as a Specialized Asset. Specialized Asset handling applies only when the asset does not process, store, or transmit CUI. Since the workstation outputs CUI, it must be assessed fully against CMMC practices.

Exact extracts:

''CUI Assets are those that process, store, or transmit CUI.''

''Specialized Assets... do not process, store, or transmit CUI.''

''If a Specialized Asset processes CUI, it must be categorized as a CUI Asset and is assessed against all applicable practices.''

Why the other options are incorrect:

B: The issue is not with the SSP practice; it is with misclassification of an asset.

C/D: Risk-based treatment applies only to Specialized Assets without CUI, which is not the case here.

CMMC Level 2 Scoping Guide -- Specialized Assets; CUI Asset definitions.

===========