Analyze the CMMC Assessment Scope of Controlled Unclassified Information (CUI) Assets Using the Five Categories of CUI Assets as Defined in the CMMC Level 2 Assessment Scoping Guide CCA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   During a CMMC Level 2 assessment, the assessor must determine the assessment scope boundary. Which of the following correctly defines the boundary of the assessment scope for CUI assets?

   • AThe boundary includes all systems that store, process, or transmit CUI, plus any interconnected systems and external service providers that could affect the confidentiality of that CUI.
   • BThe boundary includes only the physical hardware and on-premises servers where CUI is stored, regardless of network connections or cloud services.
   • CThe boundary is defined by the organization's internal network perimeter, including all devices connected to that network, but excluding any external cloud or third-party services.
   • DThe boundary is limited to only those assets that directly store or process CUI, excluding any external service providers or interconnected systems.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following assets would be classified as a specialized asset in the CMMC Level 2 scoping context?

   • AA building access control system that is connected to the network and can affect CUI security
   • BA laptop that is used to access CUI
   • CA network switch that connects CUI assets
   • DA firewall that protects the CUI network
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following should be included in the documentation of the assessment scope for CUI assets?

   • AA list of CUI assets and the rationale for including or excluding each asset
   • BA list of all assets in the organization, regardless of relevance
   • CThe names and contact information of all employees
   • DA description of the assessment methodology and tools used
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An organization has a server that stores CUI but is also used for non-CUI business applications. How should this asset be categorized for a CMMC Level 2 assessment?

   • AAs a contractor risk managed asset, because it is not exclusively for CUI
   • BAs a CUI asset, because it stores CUI
   • CAs a security protection asset, because it is used for business applications
   • DAs a specialized asset, because it is not dedicated to CUI
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which CUI asset category includes assets that provide security functions to protect CUI assets, such as firewalls, authentication servers, and monitoring tools?

   • ACUI assets
   • BSpecialized assets
   • CContractor risk managed assets
   • DSecurity protection assets
   Reveal Solution Discussion Select an answer first