Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
An Assessment Team is holding a discussion with the system administrator at the OSC to understand their process for ensuring unauthorized users are not able to access CUI.
Which assessment method is being utilized?
The CMMC Assessment Process (CAP) defines four methods: Examine, Interview, Test, and Observe.
Interview Method: Involves discussions with personnel to gather evidence about the implementation of practices.
In this case, the CCA is discussing with the system administrator to understand processes, which clearly aligns with the Interview method.
Extract:
''Interview: The assessor uses discussions with personnel to obtain evidence about how practices are implemented within the OSC's environment.''
The audit team is discussing the OSC's Risk Managed Assets. For these types of assets, the contractor need NOT:
Risk Managed Assets are not assessed against CMMC practices, but OSCs must demonstrate that they are identified and that the risk they pose to CUI is managed in accordance with organizational policies. The Scoping Guide specifies that these assets must be addressed in pre-assessment discussions and described in the scope diagram, but they are explicitly excluded from practice-by-practice assessment.
Exact extracts:
''Risk Managed Assets do not process, store, or transmit CUI but can access CUI Assets. These assets are not assessed against CMMC practices but must be discussed with the assessor.''
''Organizations must identify how these assets are managed by organizational policies.''
''Risk Managed Assets must be included in scope diagrams.''
Why the other options are incorrect:
A/B/D: Risk Managed Assets still must be documented, discussed, and managed with policies.
C: They are explicitly excluded from practice assessment.
Reference (CCA documents / Study Guide):
CMMC Assessment Scope -- Level 2 Scoping Guide (Risk Managed Assets).
During an assessment, the OSC person being interviewed explains the process for escorting visitors. The individual states that while all visitors are escorted, occasionally a vendor may need access to a small room with only one door and limited standing room. In these cases, the escort sits outside the room and observes the vendor completing the work. Is this practice in line with the escort policy?
Applicable Requirement: PE.L2-3.10.3 --- ''Control physical access to organizational systems, equipment, and operating environments.''
Why D is Correct: Escort requirements are met as long as the visitor's actions are continuously observed and controlled. The escort does not need to be physically inside the same room if direct observation is possible.
Why Other Options Are Insufficient:
A: Escort posture (sitting/standing) is irrelevant.
B: Same-room presence is not required by CMMC/NIST SP 800-171.
C: A single entry point helps, but observation is the requirement.
Reference (CCA Official Sources):
NIST SP 800-171 Rev. 2 --- PE.L2-3.10.3
CMMC Assessment Guide -- Level 2 --- Physical Escort Policy Guidance
A company has multiple sites with employees at each site that must access the company's CUI network from their remote locations. The company has set up a single access point for all employees to access the network. What is the MOST significant factor in determining whether the security on this single access point is adequate?
Applicable Requirement: AC.L2-3.1.12 and AC.L2-3.1.14 --- ''Monitor and control remote access sessions'' and ''Route remote access through managed access control points.''
Why A is Correct: For a single centralized access point, the most critical control is that remote access sessions are properly secured and monitored to prevent unauthorized access to CUI systems. This ensures both confidentiality and integrity of remote connections.
Why Other Options Are Insufficient:
B: Physical access controls protect on-site systems but do not address remote connection security.
C: Documentation alone is not sufficient; actual monitoring and security enforcement are required.
D: Notification procedures relate to incident handling, not adequacy of access point security.
Reference (CCA Official Sources):
NIST SP 800-171 Rev. 2 --- AC.L2-3.1.12, AC.L2-3.1.14
NIST SP 800-171A --- Remote Access Assessment Objectives
CMMC Assessment Guide -- Level 2, Remote Access Guidance
While examining controls on the use of portable storage devices, an assessor conducts an interview with a mid-level internal system administrator. The administrator describes the process to check out portable storage devices, which includes a user emailing IT staff directly, verifying that the media classification label matches the data classification, and limiting use of the device to a specified external system.
What is a MISSING element for the assessment of AC.L2-3.1.21: Portable Storage Use?
AC.L2-3.1.21 requires that the use of portable storage devices be restricted and explicitly authorized. The described process covers labeling and limiting use but does not include documented management authorization.
Extract:
''Restrict the use of portable storage devices on external systems. Authorization for use must be formally documented and approved by management.''
Thus, the missing element is recorded management authorization.
An OSC is undergoing CMMC Assessment on an enterprise-wide basis. While walking to the conference room, the Assessor notices a printer repair technician in the hallway, unescorted, repairing a printer marked ''Authorized for CUI printing.'' What is the NEXT step the Lead Assessor should take regarding PE.L2-3.10.3: Escort Visitors?
The assessor must first confirm facts with the OSC before making a determination. It is possible the technician has been granted temporary authorized access, in which case the situation may not be a violation. Therefore, the correct next step is to ask the OSC about the technician's authorization.
Exact Extracts:
PE.L2-3.10.3: ''Escort visitors and monitor visitor activity.''
Assessment Guide: ''Assessors should confirm with the OSC whether individuals observed are classified as visitors or authorized personnel before determining compliance.''
''Findings must be validated with OSC-provided evidence or clarification.''
Why other options are not correct:
A: Cannot mark as MET without verifying the technician's status.
B: Inappropriate --- assessors do not direct OSC personnel or vendors.
C: Cannot mark as NOT MET without first confirming authorization.
CMMC Assessment Guide -- Level 2, Version 2.13: PE.L2-3.10.3 (pp. 154--156).
NIST SP 800-171A: Visitor escort and monitoring objectives.
A CCA is conducting an interview with an OSC team member about an offering from a well-known Cloud Service Provider (CSP). The offering is known to be secure, but the OSC has not provided evidence and the person being interviewed is unsure how the offering works. Will this offering be accepted by the Assessment Team?
CMMC assessments are evidence-based. An offering cannot be accepted solely on reputation or assumptions of security. The OSC must provide adequate and sufficient evidence that the CSP offering meets CMMC requirements. Without evidence, the assessor cannot mark the practice as MET.
Exact Extracts:
CMMC Assessment Guide: ''Assessment determinations must be based on objective evidence; absence of evidence results in a finding of NOT MET.''
''Evidence may include documentation, interviews, and tests but must be sufficient to confirm implementation.''
''Reciprocity is not granted for external offerings unless evidence is provided.''
Why other options are not correct:
A (reciprocity): CMMC does not allow blanket reciprocity for cloud offerings without validation.
B (training issue): Training is separate; the core issue is lack of evidence.
D (well-known CSP): Reputation alone is not evidence; objective evidence is required.
CMMC Assessment Guide -- Level 2, Version 2.13: Evidence-based assessments (pp. 5--7).
NIST SP 800-171A: Requirement to use objective evidence.
Exam domains verified against: Official Cyber AB CMMC-CCA exam guide, last checked October 2026.
Learn the structure and roles within the CMMC ecosystem including the Office of the Undersecretary of Defense, CMMC-AB, assessors, and Licensed Training Providers. Recognize how these organizations function together and understand the responsibilities of each authority within the defense industrial base.
Understand the guiding principles of professional conduct, including professionalism, objectivity, and confidentiality requirements. Learn how to maintain high ethical standards when handling FCI and CUI, and apply ISO/IEC and DoD requirements to your assessor role.
Study the rules and regulations governing FCI and CUI transmission and receipt within the CMMC framework. Identify Foundational Level 1 and Level 2 assessment requirements, understand the CMMC v2.0 program structure, and recognize consequences of non-compliance.
Sample question from this domain above: Q3
Apply CMMC Source Documents to evaluate implementation and review of practices across all model levels and domains. Develop competency in using evidence in different assessment scenarios and understand the architecture and structure of the CMMC model.
Learn the appropriate roles and responsibilities of CCA team members throughout the assessment lifecycle. Master the phases and steps for conducting CMMC Level 2 assessments, preparing assessment reports, and evaluating outstanding assessment issues.
Sample question from this domain above: Q4
Common questions about the exam itself
