Cyber AB CMMC-CCA Exam With Confidence Using Practice Dumps

Applicable Requirement: PE.L2-3.10.3 — “Control physical access to organizational systems, equipment, and the respective operating environments.”

Why A is Correct: Security guards are a recognized preventive and detective physical control to limit access to only authorized individuals. Guards can verify credentials, monitor behavior, and provide real-time deterrence.

Why Other Options Are Insufficient:

B (Cameras): Provide monitoring and evidence, but not direct access control.

C (Firewalls): A network control, not a physical access measure.

D (Partition walls): Barriers may help physically separate areas but do not control who enters.

References (CCA Official Sources):

NIST SP 800-171 Rev. 2 — PE.L2-3.10.3

NIST SP 800-171A — PE.L2-3.10.3 Assessment Objectives

CMMC Assessment Guide – Level 2 — Physical Security Controls

===========

CMMC requires that remote maintenance sessions be terminated after use or after a defined period of inactivity. This ensures third-party maintenance access does not remain open and uncontrolled, preventing unauthorized persistence.

Exact Extracts:

MA.L2-3.7.5: “Require multifactor authentication and terminate remote maintenance sessions after each session or after a defined period of inactivity.”

Assessment Guide clarifies: “Assessors should confirm remote maintenance sessions are automatically terminated using technical means.”

NIST SP 800-171A Objective: “Test maintenance session termination after a set time of inactivity or completion of task.”

Why other options are not correct:

A: Limiting maintenance to third parties only is not a requirement. Internal staff may also perform maintenance.

B: Identification and monitoring are important, but the specific control required here is termination of remote sessions.

C: Limiting the number of personnel is not mandated by CMMC.

According to CMMC Scoping Guidance, assets controlled by a parent organization are out-of-scope when they are physically and logically isolated from the OSC’s environment and do not process, store, or transmit CUI within the OSC’s boundary.

Extract from Scoping Guidance:

“Out-of-Scope assets are those that cannot process, store, or transmit CUI because they are physically or logically separated from CUI assets, or they are inherently unable to do so.”

Since the badge activation machine is completely isolated and managed by the parent organization, and it has no network connectivity to the OSC, it is out-of-scope.