Demonstrate Understanding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in Nonfederal Unclassified Networks CCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Who is responsible for implementing the security requirements to protect FCI and CUI in a contractor's nonfederal network?

   • AThe CMMC assessor
   • BThe end user
   • CThe contractor
   • DThe government agency
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A government contractor has a system that processes both FCI and CUI. The contractor's employees are trained on FCI handling but not on CUI handling. Which of the following is the most appropriate action for the contractor to take?

   • AAssign CUI handling to a single employee who is already trained on FCI.
   • BContinue with FCI training only, since CUI is handled similarly to FCI.
   • CProvide training to employees on CUI handling, including identification, marking, and safeguarding requirements.
   • DStop processing CUI until the contract is renegotiated.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A defense contractor receives a contract from the U.S. Department of Defense. The contract includes a data requirements list that specifies delivery of technical reports containing information that is not classified but is marked as 'Controlled Unclassified Information' under the CUI program. The contractor's IT team is configuring a new file server for these reports. Which of the following is the most appropriate action for the contractor to take?

   • ASince the information is unclassified, store it on any system without additional security controls.
   • BApply the security requirements specified in the contract and NIST SP 800-171 to the file server, and train employees on CUI handling.
   • CStore the reports on a system that meets the requirements for classified information, since CUI is a form of classified data.
   • DTreat the reports as FCI and apply only the basic safeguarding requirements of FAR clause 52.204-21.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A contractor receives an email from a federal agency with an attachment that is marked 'CUI//PRIV' at the top and bottom. The email also contains a footer that says 'CUI' in the header. Which of the following is the most appropriate action for the contractor to take?

   • ADisregard the marking because the email is not a formal document.
   • BProtect the attachment according to the requirements for the CUI category 'PRIV' (Privacy).
   • CTreat the attachment as FCI because it is unclassified and provided by the government.
   • DTreat the attachment as classified because it contains privacy information.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which security framework is primarily used to protect CUI in nonfederal systems?

   • AFAR clause 52.204-21
   • BNIST SP 800-171
   • CCMMC Level 1
   • DISO 27001
   Reveal Solution Discussion Select an answer first