Cyber AB CMMC-CCA Exam With Confidence Using Practice Dumps

Applicable Requirement (CMMC Scoping Guidance – Specialized Assets): Specialized Assets (e.g., OT, IoT, GFE, test equipment) are not exempt from CMMC practices. OSCs must provide:

Documented identification in SSP/inventory,

Justification of specialized handling,

Evidence that risk-based security measures are implemented.

Why D is Correct: Assessors must see evidence that isolation is actually implemented (not just planned), plus supporting artifacts showing how remaining applicable practices are addressed (monitoring, inventory, access, etc.). Planned measures alone are insufficient.

Why Other Options Are Insufficient:

A: Installation/config builds do not show operational isolation.

B: Scoping statements alone do not demonstrate implementation.

C: SSP language is descriptive but must be supported by implementation evidence.

References (CCA Official Sources):

CMMC Scoping Guidance — Specialized Assets

CMMC Assessment Guide – Level 2 — Evidence Requirements for Specialized Assets

NIST SP 800-171 Rev. 2 — Asset Management and Risk-Based Controls

CMMC requires physical access to systems containing or transmitting CUI to be limited to authorized individuals and for access records to be maintained. Badge readers with unique identification provide individual accountability, access control enforcement, and auditable access logs, which are stronger than labels, cameras, or keypads.

Exact Extracts:

PE.L2-3.10.1: “Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.”

PE.L2-3.10.5: “Maintain audit logs of physical access.”

CMMC Assessment Guide: “Badge systems with access control lists and logs are considered a best method for meeting physical access requirements.”

Why the other options are not correct:

A: Labels and lists do not prevent unauthorized access.

C: Cameras monitor but do not restrict access; they are detective, not preventive.

D: Keypads do not provide individual accountability (codes can be shared).

MA.L2-3.7.1 (Perform Maintenance) requires that maintenance activities and risks associated with outdated or unsupported systems be managed. Unsupported systems create a security risk if not mitigated, particularly when they process CUI.

Extract:

“Maintenance must be performed and documented to ensure continued secure operation. When systems cannot be updated or patched due to technical limitations, the OSC must implement and document risk mitigation strategies.”

Because the OSC has not demonstrated risk management for the outdated OT system, the practice is NOT MET.