Analyze the CMMC Assessment Scope of Controlled Unclassified Information (CUI) Assets Using the Five Categories of CUI Assets as Defined in the CMMC Level 2 Assessment Scoping Guide CCA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of documenting the rationale for including or excluding assets in the CMMC Level 2 assessment scope?

   • ATo provide a list of assets for the organization's asset management system
   • BTo justify the cost of the assessment to the organization
   • CTo ensure that all assets are included in the assessment
   • DTo provide evidence that the assessment was conducted in accordance with the scoping guide
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   During the scoping process for a CMMC Level 2 assessment, what is the first step an assessor should take to determine which assets are in scope?

   • AIdentify all assets that process, store, or transmit CUI
   • BClassify all assets into the five categories before identifying CUI assets
   • CIdentify all assets connected to the network, regardless of CUI involvement
   • DDocument the rationale for excluding assets from scope
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has a shared workstation that is used by employees to access CUI via a web portal. The workstation does not store CUI locally. The workstation is also used for non-CUI tasks. How should the workstation be classified?

   • ACUI asset because it processes CUI when accessing the portal.
   • BSpecialized Asset because it is used for multiple purposes.
   • CSecurity Protection Asset (SPA) because it is shared.
   • DOut of scope because it does not store CUI.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a key output of the CMMC Level 2 scoping process for CUI assets?

   • AA documented inventory of CUI assets and the rationale for their inclusion or exclusion
   • BA list of all assets in the organization, including personal devices
   • CA network diagram showing all connections to external service providers
   • DA list of all security protection assets and their configurations
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization has a firewall that inspects traffic between the CUI enclave and the rest of the network. The firewall logs contain metadata about CUI traffic but do not store CUI content. According to the CUI asset categories, how should the firewall be classified?

   • ASecurity Protection Asset (SPA)
   • BCUI asset
   • CSpecialized Asset
   • DOut of scope
   Reveal Solution Discussion Select an answer first