Evaluate the CMMC Assessment Scope Considerations Based on the CMMC Level 2 Assessment Scoping Guide CCA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization has a server room that houses CUI-processing servers. The room is protected by a badge reader, and only authorized personnel have access. The organization also has a visitor log. According to the CMMC Level 2 Assessment Scoping Guide, how should the assessor document the physical security of the server room?

   • ADocument the badge reader as a specialized asset
   • BInclude the visitor log as a contractor risk managed asset
   • CInclude the physical security controls as part of the assessment scope
   • DExclude the physical security controls because they are not IT assets
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a required element of documenting the assessment scope for a CMMC Level 2 assessment?

   • AA list of all software licenses owned by the organization
   • BA copy of the organization's marketing materials
   • CA list of all employees and their job titles
   • DA justification for each asset included in or excluded from the scope
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In CMMC Level 2 scoping, which asset category includes assets that provide security functionality to CUI assets?

   • ASecurity protection assets
   • BCUI assets
   • CSpecialized assets
   • DContractor risk managed assets
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is an example of a specialized asset in CMMC Level 2 scoping?

   • AA building access control system that uses IoT sensors
   • BA standard desktop computer used by an employee to access CUI
   • CA network firewall that protects the CUI environment
   • DA file server that stores CUI documents
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When scoping for external service providers in a CMMC Level 2 assessment, what must be determined?

   • AWhether the ESP processes, stores, or transmits CUI on behalf of the organization
   • BWhether the ESP has a formal contract with the organization
   • CWhether the ESP has a physical office in the United States
   • DWhether the ESP is a publicly traded company
   Reveal Solution Discussion Select an answer first