Exam CMMC-CCA Topic 3 Question 60 Discussion

Actual exam question for Cyber AB's CMMC-CCA exam
Question #: 60
Topic #: 3

An OSC is a wholly owned subsidiary of a large conglomerate (parent organization). The OSC and the parent organization use ID badges (PKI cards) that contain a PKI certificate and a radio frequency identification (RFID) tag used for building and system access (including systems that process, transmit, or store CUI). The parent organization does not make any decisions on how the OSC runs its security program or other matters of significance. The large conglomerate operates a machine that is used to activate the badges for both itself and the OSC. This machine is isolated in a locked room and has no network connectivity to the OSC.
The badge activation system is:

A. In-scope because the parent organization acts as an External Service Provider to the OSC by providing PKI cards. B. In-scope because the OSC is part of the large conglomerate and thus any CMMC requirements of the OSC are imputed onto the large conglomerate. C. Out-of-scope because the OSC is the one that assigns the appropriate access to a particular PKI card. D. Out-of-scope because the badge activation machine is physically and logically isolated from the OSC and it is under the control of the parent organization.

Suggested Answer: D Vote an answer

According to CMMC Scoping Guidance, assets controlled by a parent organization are out-of-scope when they are physically and logically isolated from the OSC's environment and do not process, store, or transmit CUI within the OSC's boundary.
Extract from Scoping Guidance:
"Out-of-Scope assets are those that cannot process, store, or transmit CUI because they are physically or logically separated from CUI assets, or they are inherently unable to do so." Since the badge activation machine is completely isolated and managed by the parent organization, and it has no network connectivity to the OSC, it is out-of-scope.
Reference: CMMC Scoping Guidance, Level 2.

by Iris at Aug 26, 2026, 12:03 PM

Limited Time Offer

15%

Off

Get Premium CMMC-CCA Questions as Interactive Self Test Engine or PDF

Comments

0 Happy Clients

0 Shares

0 Demo Downloads

10 Years in Business