Evaluate the CMMC Assessment Scope Considerations Based on the CMMC Level 2 Assessment Scoping Guide CCA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization hosts a CUI-processing application on a virtual machine in a multi-tenant cloud environment. The hypervisor is managed by the cloud provider. The organization has no visibility into the hypervisor's configuration. According to the CMMC Level 2 Assessment Scoping Guide, how should the assessor handle the hypervisor?

   • ADocument the hypervisor as an external dependency and assess the cloud provider's controls
   • BExclude the hypervisor from scope because the organization has no visibility
   • CInclude the hypervisor as a security protection asset, since it isolates VMs
   • DInclude the hypervisor as a CUI asset, since it hosts the VM
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which asset category in CMMC Level 2 scoping includes assets that are not owned by the organization but are managed by a contractor and could affect the confidentiality of CUI?

   • ACUI assets
   • BContractor risk managed assets
   • CSpecialized assets
   • DSecurity protection assets
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During the scoping phase, the assessor identifies a legacy server that stores CUI but is scheduled for decommissioning in six months. The organization argues that the server should be excluded from scope because it is being replaced. According to the CMMC Level 2 Assessment Scoping Guide, what should the assessor do?

   • AExclude the server because it is being decommissioned
   • BInclude the server and document the decommissioning plan as a justification
   • CExclude the server and document the replacement plan
   • DInclude the server as a contractor risk managed asset
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a key scoping consideration for a CMMC Level 2 assessment?

   • AThe number of employees in the organization
   • BThe physical location of the organization's headquarters
   • CThe assets that process, store, or transmit CUI, and the users who access them
   • DThe organization's total annual revenue
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of the CMMC Level 2 Assessment Scoping Guide?

   • ATo define the specific security requirements that must be implemented for each CMMC practice
   • BTo specify the penalties for non-compliance with CMMC Level 2 requirements
   • CTo list the exact evidence documents required for every CMMC Level 2 assessment
   • DTo provide guidance on how to determine which assets, users, and external dependencies are included in the assessment boundary
   Reveal Solution Discussion Select an answer first