Exam CMMC-CCA Topic 1 Question 72 Discussion

Actual exam question for Cyber AB's CMMC-CCA exam
Question #: 72
Topic #: 1
You are working as a CCA on a Level 2 Assessment for a DoD prime contractor. The Organization Seeking Certification (OSC) seeks to keep assessment costs down, and the C3PAO and OSC have decided to conduct all possible work remotely. You are assigned to work primarily on the Media Protection (MP), Personnel Security (PS), and Physical Protection (PE) domains. In addition, the Lead Assessor has designated you as the one person from the Assessment Team to conduct all the on-premises work. Which of the following factors do you and the Assessment Team not need to consider as part of your on-site work?

Suggested Answer: D Vote an answer

Comprehensive and Detailed in Depth Explanation:
The CMMC Assessment Process (CAP) v1.0 specifies that certain practice objectives, particularly in domains like Media Protection (MP), Personnel Security (PS), and Physical Protection (PE), require on-premises observation due to their physical nature (e.g., MP.L2-3.8.7, PE.L2-3.10.2). As the designated on-site assessor, your focus is on validating these objectives in person. The CAP identifies 15 practice objectives requiring on- site verification, emphasizing critical areas where CUI is processed, stored, or protected.
Option A (DoD-approved collaboration tools) and Option C (Virtual Assessment Evidence Preparation Template) pertain to virtual assessment logistics, not your on-site responsibilities. Option B (limitations of on- premises assessments) is relevant as it addresses potential constraints you must navigate for MP, PS, and PE domains. However, Option D (non-critical areas of OSC facilities) is irrelevant because your on-site work targets only areas within the assessment scope where CUI-related practices are implemented, not non-critical areas unrelated to CMMC compliance. Thus, Option D is the correct answer.
Reference Extract:
* CMMC Assessment Process (CAP) v1.0, Section 3.5.2:"Fifteen practice objectives across MP, PS, and PE domains require on-premises observation to validate implementation."
* CMMC AG Level 2, Section 3.10:"Physical protection practices must be assessed in areas where CUI is present, not non-critical facility zones."Resources:https://cyberab.org/Portals/0/Documents/Process- Documents/CMMC-Assessment-Process-CAP-v1.0.pdf;https://dodcio.defense.gov/Portals/0/Documents
/CMMC/AG_Level2_MasterV2.0_FINAL_202112016_508.pdf

by Baldwin at Aug 07, 2026, 05:49 PM

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

0
0
0
10