[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-395389-105":59,"doc-detail-395389-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","cyber-ab-cmmc-cca-certified-cmmc-assessor-cca-exam-product-version-90-practice-question","Cyber AB - CMMC-CCA Certified CMMC Assessor (CCA) Exam - Product Version 9.0 Practice Question","","Exam preparation material for the Cyber AB CMMC-CCA Certified CMMC Assessor (CCA) exam, focusing on CMMC/NIST AC control practices for limiting and verifying connections to external systems. Includes a multiple-choice scenario about employee policy, firewalls, and connection allow-lists, with the correct selection and detailed explanation referencing CMMC/NIST requirements such as AC.L2-3.1.20 and NIST SP 800-171A assessment objectives. Also contains a second question on which OSC documentation best supports security control evidence when using External Service Providers (ESPs), with answers and rationale.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":20,"@type":76,"position":81},"https://docshare.wps.com/document/exam/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/cyber-ab-cmmc-cca-certified-cmmc-assessor-cca-exam-product-version-90-practice-question/395389/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/cyber-ab-cmmc-cca-certified-cmmc-assessor-cca-exam-product-version-90-practice-question/395389.png","ImageObject",300,407,{"name":92,"@type":93},"Jacob","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-29","2026-09-26",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",22,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What safeguards best meet the CMMC requirement for limiting connections to external systems in the first scenario?","Question",{"text":113,"@type":114},"The correct choice is to use firewalls and a connection allow-list, as they provide the technical controls needed to verify and limit external connections under AC.L2-3.1.20.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Is complete isolation from all external connections required to meet AC.L2-3.1.20?",{"text":118,"@type":114},"No. The requirement allows individuals to access external systems when connections do not compromise or harm organizational systems; complete isolation is not mandated.",{"name":120,"@type":111,"acceptedAnswer":121},"When an OSC uses an External Service Provider (ESP), what document most likely provides acceptable evidence of security controls at the interface?",{"text":122,"@type":114},"The most likely acceptable evidence is the interconnection agreement (e.g., contract or memorandum) defining the security requirements, responsibilities, and terms governing the OSC-ESP connection.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},395389,1790508542,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":19,"category_name":20,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":34,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145,"preview_page_count":8,"preview_urls":146},962084931830,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","Boost up Your Certification Score  \nCyber AB  \nCMMC-CCA Certified CMMC Assessor (CCA) Exam  \nFor More Information – Visit link below:  \n[https://www.examsboost.com/](https://www.examsboost.com/)  \nProduct Version  \n􀀹 Up to Date products, reliable and verified.  \n􀀹 Questions and Answers in PDF Format .  \nVisit us at: [https://www.examsboost.com/test/cmmc-cca](https://www.examsboost.com/test/cmmc-cca)  \nLatest Version: 9.0  \nWhile assessing a company, the CCA is determining whether the company controls and manages connections between its corporate network and all external networks. The company has: (1) a strict employee policy prohibiting personal Internet use and personal email on company computers, and (2) firewalls plus a connection allow-list so only authorized external networks can connect to the company network. Are these safeguards sufficient to meet the applicable CMMC requirement?  \nA. Yes. The company’s strict employee policy is the best practice for meeting the requirement.  \nB. No. The company must isolate its system from all external connections to meet the requirement.  \nC. Yes. The company’s firewalls and connection allow-lists are appropriate technical controls to meet the requirement.  \nD. No. The company needs full control over all external systems it interfaces with to meet the requirement.  \nAnswer: C  \nExplanation:  \nApplicable CMMC/NIST Requirement: AC. L2-3.1.20—“Verify and control/limit connections to and use of external systems.”  \nIsolation Not Required (refutes B): The requirement acknowledges that individuals using external systems (e.g., contractors, partners) may need to access organizational systems. In such cases, organizations must ensure those connections do not compromise or harm organizational systems. Therefore, complete isolation from all external systems is not mandated.  \nPolicy Alone is Insufficient (refutes A): Assessment guidance requires mechanisms that technically enforce terms and conditions for use of external systems. A written employee policy by itself does not satisfy the requirement unless paired with technical enforcement (e.g., firewalls, connection rules) .  \nAllow-lists & Firewalls are Best Practice (supports C): Assessment considerations specify that organizations should restrict external systems to an approved list, such as by using firewalls, VPNs, IP restrictions, or certificates. The company’s use of firewalls and a connection allow-list directly addresses this requirement.  \nFull Control of External Systems Not Required (refutes D): The definition of “external systems”  \nclarifies that organizations typically do not have direct supervision or authority over those systems. The requirement is to limit and control connections to such systems, not to own or fully manage them.  \nAssessment Objectives for AC. L2-3.1.20 (from NIST SP 800-171A):  \nConnections to external systems are identified.  \nUse of external systems is identified.  \nConnections to external systems are verified.  \nUse of external systems is verified.  \nConnections to external systems are controlled/limited.  \nVisit us at: [https://www.examsboost.com/test/cmmc-cca](https://www.examsboost.com/test/cmmc-cca)  \nUse of external systems is controlled/limited.  \nFirewalls and allow-lists satisfy these verification and limitation requirements, enabling a CCA to mark the practice MET if evidence is present.  \nReference (CCA Official Sources):  \nNIST SP 800-171 Rev. 2—§3 .1. 20 (Discussion)  \nNIST SP 800-171A—§3 .1. 20 (Assessment Objectives & Methods)  \nCMMC Assessment Guide – Level 2, Version 2.13—AC. L2-3.1.20 (External Connections [CUI Data], including “Potential Assessment Considerations”)  \nThe OSC has assembled its documentation relating to how it controls remote access for assessment. The Lead Assessor compared this documentation to the provided topology map and noted several indications of external connections with External Service Providers (ESPs) . Which document is MOST LIKELY to show acceptable evidence ","cbCaitytjicIQcoc","https://ap.wps.com/l/cbCaitytjicIQcoc","pdf",443897,"English","# CMMC-CCA Exam Practice Questions\n## Question 1: External Systems Connection Controls\n## Question 2: Evidence for OSC-ESP Interface Controls","[{\"question\":\"What safeguards best meet the CMMC requirement for limiting connections to external systems in the first scenario?\",\"answer\":\"The correct choice is to use firewalls and a connection allow-list, as they provide the technical controls needed to verify and limit external connections under AC.L2-3.1.20.\"},{\"question\":\"Is complete isolation from all external connections required to meet AC.L2-3.1.20?\",\"answer\":\"No. The requirement allows individuals to access external systems when connections do not compromise or harm organizational systems; complete isolation is not mandated.\"},{\"question\":\"When an OSC uses an External Service Provider (ESP), what document most likely provides acceptable evidence of security controls at the interface?\",\"answer\":\"The most likely acceptable evidence is the interconnection agreement (e.g., contract or memorandum) defining the security requirements, responsibilities, and terms governing the OSC-ESP connection.\"}]","Cyber AB - CMMC-CCA Certified CMMC Assessor (CCA) Exam - Product Version 9.0 Practice Question | PDF",1790418790,18,[147],{"page_no":8,"url":148,"width":149,"height":150},"https://res-academy.cache.wpscdn.com/upload/kdocshare/2026-11-08/5808c40be6136d66cc81b1cd10b2ac26.webp",983,1390]