Exam CMMC-CCA Topic 1 Question 85 Discussion
Actual exam question for Cyber AB's CMMC-CCA exam
Question #: 85
Topic #: 1
Question #: 85
Topic #: 1
Any user that accesses CUI on system media should be authorized and have a lawful business purpose. While assessing a contractor's implementation of MP.L2-3.8.2 - Media Access, youexamine the CUI access logs and the role of employees. Something catches your eye where an ID of an employee listed as terminated regularly accesses CUI remotely. Walking into the contractor's facilities, you observe the janitor cleaning an office where documents marked CUI are visible on the table. Interviewing the organization's data custodian, they informed you that a media storage procedure is augmented by a physical protection and access control policy. Based on the scenario and the requirements of CMMC practice MP.L2-3.8.2 - Media Access, which of the following actions would be the highest priority recommendation for the contractor?
Suggested Answer: B Vote an answer
Comprehensive and Detailed In-Depth Explanation:
CMMC practice MP.L2-3.8.2 - Media Access requires organizations to "restrict access to CUI on system media to authorized users." The scenario reveals a critical failure: a terminated employee's ID continues to access CUI remotely, indicating a lack of timely revocation processes. This poses an immediate security risk, as unauthorized access to CUI violates the practice's core intent. Developing and implementing a process to disable access upon termination (B) directly addresses this gap and is the highest priority to ensure compliance and protect CUI. Training (A) is beneficial but doesn't fix the revocation issue, logging (C) is already partially in place and doesn't address termination, and new technology (D) is secondary to procedural fixes. The CMMC guide emphasizes timely access control as critical.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), MP.L2-3.8.2: "Restrict media access to authorized users; ensure processes revoke access when no longer needed."
* NIST SP 800-171A, 3.8.2: "Examine processes for removing access upon termination." Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf
CMMC practice MP.L2-3.8.2 - Media Access requires organizations to "restrict access to CUI on system media to authorized users." The scenario reveals a critical failure: a terminated employee's ID continues to access CUI remotely, indicating a lack of timely revocation processes. This poses an immediate security risk, as unauthorized access to CUI violates the practice's core intent. Developing and implementing a process to disable access upon termination (B) directly addresses this gap and is the highest priority to ensure compliance and protect CUI. Training (A) is beneficial but doesn't fix the revocation issue, logging (C) is already partially in place and doesn't address termination, and new technology (D) is secondary to procedural fixes. The CMMC guide emphasizes timely access control as critical.
Extract from Official CMMC Documentation:
* CMMC Assessment Guide Level 2 (v2.0), MP.L2-3.8.2: "Restrict media access to authorized users; ensure processes revoke access when no longer needed."
* NIST SP 800-171A, 3.8.2: "Examine processes for removing access upon termination." Resources:
* https://dodcio.defense.gov/Portals/0/Documents/CMMC/AG_Level2_MasterV2.
0_FINAL_202112016_508.pdf
by Orville at Oct 29, 2026, 06:50 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).