Evaluate the CMMC Assessment Scope Considerations Based on the CMMC Level 2 Assessment Scoping Guide CCA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A manufacturing company has an industrial control system (ICS) that monitors a production line. The ICS does not store CUI, but it receives instructions from a CUI-processing server. The ICS has no internet connectivity and is isolated from the corporate network. According to the CMMC Level 2 Assessment Scoping Guide, how should the ICS be classified?

   • ASpecialized asset, because it is an operational technology system
   • BCUI asset, because it receives instructions from a CUI server
   • CContractor risk managed asset, because it is not CUI-related
   • DSecurity protection asset, because it is isolated
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why are physical security considerations included in the CMMC Level 2 assessment scope?

   • ABecause physical security is only relevant for on-premises assets
   • BBecause physical security is a requirement only for Level 2, not for other levels
   • CBecause physical security is a separate assessment that does not affect the scope
   • DBecause physical security controls protect CUI assets from unauthorized physical access
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company allows employees to access CUI from their personal smartphones via a remote desktop application. The smartphones are not enrolled in any mobile device management (MDM) solution. According to the CMMC Level 2 Assessment Scoping Guide, how should the assessor treat these personal smartphones?

   • AInclude them as CUI assets, since they access CUI
   • BExclude them from scope because they are personal devices
   • CInclude them as security protection assets, since they use remote desktop
   • DInclude them as contractor risk managed assets, since they are not managed
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization has a backup server that stores encrypted backups of CUI data. The backup server is not directly accessible by users and is only used for disaster recovery. According to the CMMC Level 2 Assessment Scoping Guide, how should the assessor classify the backup server?

   • ACUI asset, because it stores CUI backups
   • BContractor risk managed asset, because it is not directly accessible
   • CSpecialized asset, because it is used for disaster recovery
   • DSecurity protection asset, because it supports disaster recovery
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When scoping for virtualization in a CMMC Level 2 assessment, what must be considered?

   • AVirtual machines are out of scope because they are not physical assets
   • BOnly the physical host server is in scope, not the virtual machines
   • CThe hypervisor and virtual machines that handle CUI are in scope
   • DVirtualization is always out of scope because it is a shared resource
   Reveal Solution Discussion Select an answer first