Cyber AB CMMC-CCA Exam Dumps

Under AC.L2-3.1.12: Remote Access, assessors must verify that all remote access sessions are identified, authorized, controlled, and monitored. Whether remote access is ''necessary'' is a business decision, not an assessment concern. The assessor is concerned with whether it is properly controlled and implemented, not with the business justification for its existence.

Exact extracts:

''Assessment Objectives ... Determine if:

* remote access methods are identified;

* remote access is authorized prior to allowing such connections;

* remote access sessions are controlled;

* remote access sessions are monitored.''

''The requirement does not assess business necessity of remote access, only its security and authorization.''

Why the other options are important:

B: Authorization (permitted) must be verified.

C: Monitoring of remote sessions is mandatory.

D: Permitted methods must be identified (e.g., VPN, VDI, etc.).

CMMC Assessment Guide -- Level 2, AC.L2-3.1.12.

NIST SP 800-171 Rev. 2, 3.1.12.

Applicable Requirement: PE.L2-3.10.3 --- ''Control physical access to organizational systems, equipment, and the respective operating environments.''

Why A is Correct: Security guards are a recognized preventive and detective physical control to limit access to only authorized individuals. Guards can verify credentials, monitor behavior, and provide real-time deterrence.

Why Other Options Are Insufficient:

B (Cameras): Provide monitoring and evidence, but not direct access control.

C (Firewalls): A network control, not a physical access measure.

D (Partition walls): Barriers may help physically separate areas but do not control who enters.

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- PE.L2-3.10.3

NIST SP 800-171A --- PE.L2-3.10.3 Assessment Objectives

CMMC Assessment Guide -- Level 2 --- Physical Security Controls

===========

The Physical Protection (PE) practices require that visitors to facilities where CUI is processed must be escorted at all times by an authorized individual. Familiarity or long-term knowledge of the visitor does not remove the requirement.

Extract from PE.L2-3.10.3:

''Escort visitors and monitor visitor activity to ensure they do not access areas or information for which they are not authorized.''

Thus, the correct action is for the contact person (the engineer's point of contact) to escort the engineer during the entire maintenance activity.

The Physical and Environmental Protection (PE) Policy is the governing artifact that describes how physical access to facilities and environments is managed and controlled. While the SSP provides a system-wide overview, and access lists provide details of who is authorized, it is the PE Policy that explicitly documents the physical access control measures required under CMMC.

Extract from PE.L2-3.10.1:

''Organizations must develop, document, and disseminate physical and environmental protection policies that govern how access to buildings and systems containing CUI is limited to authorized individuals.''

Both the CSP's cloud environment and the OSC's on-premises network/workstations are in-scope because CUI is stored in the cloud but also accessed and transmitted by OSC assets. The cloud vendor's internal employee network is not in-scope because only the customer-facing FedRAMP environment is within the assessment boundary.

Exact extracts:

''CUI Assets include any OSC asset that stores, processes, or transmits CUI.''

''External service providers are in-scope if their services process, store, or transmit CUI on behalf of the OSC.''

''The OSC's endpoints and local infrastructure that access CUI are also in-scope.''

Why the other options are incorrect:

A: Cloud environment only is incomplete; OSC workstations also access and transmit CUI.

B: OSC network only ignores the fact that CUI is stored in the cloud.

D: The cloud vendor's internal employee network is not in-scope.

CMMC Scoping Guide -- Level 2 (CUI Assets; External Service Providers).

===========