Cyber AB - CMMC-CCA Certified CMMC Assessor (CCA) Exam - Product Version 9.0 Practice Question

Sep 26, 2026

Uploaded by Jacob

Exam preparation material for the Cyber AB CMMC-CCA Certified CMMC Assessor (CCA) exam, focusing on CMMC/NIST AC control practices for limiting and verifying connections to external systems. Includes a multiple-choice scenario about employee policy, firewalls, and connection allow-lists, with the correct selection and detailed explanation referencing CMMC/NIST requirements such as AC.L2-3.1.20 and NIST SP 800-171A assessment objectives. Also contains a second question on which OSC documentation best supports security control evidence when using External Service Providers (ESPs), with answers and rationale.

LanguageEnglish

CategoryExam

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

CMMC-CCA Exam Practice Questions

Question 1: External Systems Connection Controls

Question 2: Evidence for OSC-ESP Interface Controls

Boost up Your Certification Score Cyber AB CMMC-CCA Certified CMMC Assessor (CCA) Exam For More Information – Visit link below: [https://www.examsboost.com/](https://www.examsboost.com/) Product Version 􀀹 Up to Date products, reliable and verified. 􀀹 Questions and Answers in PDF Format . Visit us at: [https://www.examsboost.com/test/cmmc-cca](https://www.examsboost.com/test/cmmc-cca) Latest Version: 9.0 While assessing a company, the CCA is determining whether the company controls and manages connections between its corporate network and all external networks. The company has: (1) a strict employee policy prohibiting personal Internet use and personal email on company computers, and (2) firewalls plus a connection allow-list so only authorized external networks can connect to the company network. Are these safeguards sufficient to meet the applicable CMMC requirement? A. Yes. The company’s strict employee policy is the best practice for meeting the requirement. B. No. The company must isolate its system from all external connections to meet the requirement. C. Yes. The company’s firewalls and connection allow-lists are appropriate technical controls to meet the requirement. D. No. The company needs full control over all external systems it interfaces with to meet the requirement. Answer: C Explanation: Applicable CMMC/NIST Requirement: AC. L2-3.1.20—“Verify and control/limit connections to and use of external systems.” Isolation Not Required (refutes B): The requirement acknowledges that individuals using external systems (e.g., contractors, partners) may need to access organizational systems. In such cases, organizations must ensure those connections do not compromise or harm organizational systems. Therefore, complete isolation from all external systems is not mandated. Policy Alone is Insufficient (refutes A): Assessment guidance requires mechanisms that technically enforce terms and conditions for use of external systems. A written employee policy by itself does not satisfy the requirement unless paired with technical enforcement (e.g., firewalls, connection rules) . Allow-lists & Firewalls are Best Practice (supports C): Assessment considerations specify that organizations should restrict external systems to an approved list, such as by using firewalls, VPNs, IP restrictions, or certificates. The company’s use of firewalls and a connection allow-list directly addresses this requirement. Full Control of External Systems Not Required (refutes D): The definition of “external systems” clarifies that organizations typically do not have direct supervision or authority over those systems. The requirement is to limit and control connections to such systems, not to own or fully manage them. Assessment Objectives for AC. L2-3.1.20 (from NIST SP 800-171A): Connections to external systems are identified. Use of external systems is identified. Connections to external systems are verified. Use of external systems is verified. Connections to external systems are controlled/limited. Visit us at: [https://www.examsboost.com/test/cmmc-cca](https://www.examsboost.com/test/cmmc-cca) Use of external systems is controlled/limited. Firewalls and allow-lists satisfy these verification and limitation requirements, enabling a CCA to mark the practice MET if evidence is present. Reference (CCA Official Sources): NIST SP 800-171 Rev. 2—§3 .1. 20 (Discussion) NIST SP 800-171A—§3 .1. 20 (Assessment Objectives & Methods) CMMC Assessment Guide – Level 2, Version 2.13—AC. L2-3.1.20 (External Connections [CUI Data], including “Potential Assessment Considerations”) The OSC has assembled its documentation relating to how it controls remote access for assessment. The Lead Assessor compared this documentation to the provided topology map and noted several indications of external connections with External Service Providers (ESPs) . Which document is MOST LIKELY to show acceptable evidence

FAQs

What safeguards best meet the CMMC requirement for limiting connections to external systems in the first scenario?

The correct choice is to use firewalls and a connection allow-list, as they provide the technical controls needed to verify and limit external connections under AC.L2-3.1.20.

Is complete isolation from all external connections required to meet AC.L2-3.1.20?

No. The requirement allows individuals to access external systems when connections do not compromise or harm organizational systems; complete isolation is not mandated.

When an OSC uses an External Service Provider (ESP), what document most likely provides acceptable evidence of security controls at the interface?

The most likely acceptable evidence is the interconnection agreement (e.g., contract or memorandum) defining the security requirements, responsibilities, and terms governing the OSC-ESP connection.

Sep 26, 2026

Uploaded by Jacob

Cyber AB - CMMC-CCA Certified CMMC Assessor (CCA) Exam - Product Version 9.0 Practice Question_Page 1

Open in WPS to view all 7 pages