CMMC-CCA Exam Dumps and Practice Questions

The control SC.L2-3.13.5: Boundary Protection requires that organizations monitor and control communications at the external boundary and at key internal boundaries. The CMMC Assessment Guide states that assessors should examine boundary protection procedures to verify logging, monitoring, and alerting are defined and implemented. Physical access logs, account management documents, and configuration management policies do not provide details of how network boundaries are monitored and protected.

Exact extracts:

''Assessment Objectives ... Determine if: * external boundary and key internal boundaries are defined; * communications are monitored and controlled at boundaries; * traffic is checked for unauthorized transfer of information; and * boundary protection devices are configured and managed.''

''Potential Assessment Methods: Examine ... boundary protection policy; boundary protection procedures; system security plan; configuration settings for boundary protection devices; logs of boundary protection devices.''

Why the other options are incorrect:

A (Physical access logs): Relates to facility entry, not network boundary protection.

C (Account management document): Addresses user account lifecycle, not firewall and traffic control.

D (Configuration management policy): Governs system changes, not firewall logging/alerting controls.

Reference (CCA documents / Study Guide):

CMMC Assessment Guide -- Level 2, SC.L2-3.13.5 ''Boundary Protection.''

NIST SP 800-171 Rev. 2, 3.13.5.

Applicable Requirement: PE.L2-3.10.3 --- ''Control physical access to organizational systems, equipment, and the respective operating environments.''

Why A is Correct: Security guards are a recognized preventive and detective physical control to limit access to only authorized individuals. Guards can verify credentials, monitor behavior, and provide real-time deterrence.

Why Other Options Are Insufficient:

B (Cameras): Provide monitoring and evidence, but not direct access control.

C (Firewalls): A network control, not a physical access measure.

D (Partition walls): Barriers may help physically separate areas but do not control who enters.

Reference (CCA Official Sources):

NIST SP 800-171 Rev. 2 --- PE.L2-3.10.3

NIST SP 800-171A --- PE.L2-3.10.3 Assessment Objectives

CMMC Assessment Guide -- Level 2 --- Physical Security Controls

Applicable Requirement (CMMC Assessment Process): The CMMC Assessment Process (CAP) requires assessors to collect, analyze, and reconcile evidence using triangulation (examine, interview, test) to confirm whether requirements are MET or NOT MET. When inconsistencies arise, the assessor must go back to objective evidence such as diagrams, contracts, and notes.

Why Reviewing Network Diagrams Helps (supports A): Network diagrams provide authoritative evidence of scope, data flows, and system boundaries, which helps clarify whether the MSSP's services were accurately described.

Why Reviewing MSSP Agreements Helps (supports B): Agreements (such as interconnection security agreements or service-level agreements) define shared responsibilities and confirm how the MSSP supports security controls. This evidence is critical to resolving inconsistent testimony.

Why Reviewing Notes Helps (supports C): Notes from previous interviews allow the team to pinpoint where answers diverged. This is a valid method of evidence review and aligns with CAP guidance on documenting interviews.

Why Interview Questionnaire Consistency is NOT the Correct Step (refutes D): The CAP emphasizes resolving inconsistencies through additional evidence, not by adjusting or re-checking the questionnaire itself. The consistency of the questionnaire is irrelevant --- what matters is reconciling the evidence provided by both the OSC and MSSP. Thus, this is the action the Lead Assessor would NOT take.

Assessment Guidance Extract (CAP):

''When conflicting evidence is observed, the assessment team must review technical documentation, agreements, and notes to identify the root cause and determine whether additional clarification is required.''

''The interview instrument itself is not a tool for reconciling inconsistencies; rather, objective evidence must be used.''

Reference (CCA Official Sources):

CMMC Assessment Process (CAP) v1.0 --- Section 3: Conducting the Assessment (Interview, Evidence, Triangulation, and Conflict Resolution)

CMMC Assessment Guide -- Level 2, Version 2.13 --- Guidance on the role of External Service Providers (MSSPs) and use of documented agreements as evidence

NIST SP 800-171A --- General assessment methodology: reconcile evidence using examine, interview, and test methods

The CMMC Assessment Process (CAP) defines the logical order:

After collecting and examining evidence, the next step is to determine and record initial practice scores (MET, NOT MET, or NA).

Only after practice scoring is completed are findings validated and aggregated into final recommended results.

Extract:

''Following evidence collection and review, assessors determine and record the practice status (MET/NOT MET/NA) before compiling results into final recommendations.''

When protecting backup data containing CUI, the requirement is to ensure confidentiality through logical or physical security controls appropriate to the sensitivity of CUI. Acceptable implementations include controlling access to CUI (AC family controls), physically securing media (MP family controls), and encrypting files or media (SC family controls). Merely implementing alternative physical controls for site access is insufficient because site access protections do not directly ensure the confidentiality of the backup media itself.

Exact Extracts (from official CMMC Assessor/Study documents and NIST SP 800-171A references):

SC.L2-3.13.16 (Encrypt CUI): ''Employ cryptographic mechanisms to prevent unauthorized disclosure of CUI during storage and transmission unless otherwise protected by alternative physical safeguards.''

MP.L2-3.8.9 (Protect backup CUI): ''Protect the confidentiality of backup CUI at storage locations.''

AC.L2-3.1.3 (Access enforcement): ''Limit access to CUI on the basis of need-to-know to protect confidentiality.''

Physical security references (PE family): ''Physical access controls provide general site protection but are not substitutes for encryption or media protection controls when CUI confidentiality is at risk.''

Why the other options are correct (acceptable methods):

B (Managing who has access to the information): Satisfies Access Control (AC) requirements that limit exposure of CUI only to authorized individuals.

C (Physically securing devices and media): Satisfies Media Protection (MP) requirements, ensuring CUI is stored securely and protected against unauthorized access.

D (Encrypting files or media): Directly satisfies System and Communications Protection (SC) requirements for confidentiality, a highly reliable method.

Why option A is least acceptable:

Alternative physical controls for site access protect buildings or rooms, but they do not directly safeguard backup media confidentiality. If backups are removed, lost, or accessed internally, site access controls alone cannot ensure confidentiality.

Reference (official CCA/CMMC documents):

CMMC Assessment Guide -- Level 2, Version 2.13: Practices SC.L2-3.13.16, MP.L2-3.8.9, AC.L2-3.1.3, and PE family discussion (pp. 93--96, 108--110, 125--127).

NIST SP 800-171A, Assessing Security Requirements for CUI: Related assessment objectives for protecting CUI backup confidentiality.