Demonstrate Understanding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in Nonfederal Unclassified Networks CCP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which regulation defines CUI and establishes the CUI program?

   • AExecutive Order 13556
   • BNIST SP 800-171
   • C32 CFR Part 2002
   • DFAR clause 52.204-21
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does CUI differ from FCI in terms of sensitivity?

   • ABoth have the same sensitivity level
   • BFCI is more sensitive than CUI
   • CCUI is classified, while FCI is unclassified
   • DCUI is more sensitive than FCI and requires more protection
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which statement correctly compares FCI and CUI?

   • AFCI is subject to NIST SP 800-171, while CUI is subject to FAR 52.204-21
   • BFCI requires basic safeguarding, while CUI requires more comprehensive controls
   • CFCI is generated by the government, while CUI is generated by contractors
   • DFCI is always marked, while CUI is never marked
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A contractor is preparing to bid on a federal contract that will require the contractor to process CUI. The contractor currently has a system that is compliant with FAR 52.204-21 for FCI but is not compliant with NIST SP 800-171. The contractor has limited budget and time before the contract award. Which of the following is the most appropriate course of action?

   • ADecline to bid on the contract because the system is not compliant with NIST SP 800-171.
   • BContinue with the current FCI-compliant system and handle CUI on that system, since FCI and CUI have similar requirements.
   • CImplement the NIST SP 800-171 controls that are not yet in place, even if it requires additional budget and time.
   • DOutsource all CUI processing to a third-party provider that is NIST SP 800-171 compliant.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A contractor is implementing a new system to process CUI. The contractor has a limited budget and must decide between two options: (1) implement all NIST SP 800-171 controls, or (2) implement only the controls that are required by FAR 52.204-21. Which of the following is the most appropriate decision?

   • ADelay the decision until the contract is awarded and the requirements are clear.
   • BImplement only the FAR 52.204-21 controls, because they are sufficient for CUI.
   • CImplement all NIST SP 800-171 controls, because CUI requires more than the basic safeguarding of FCI.
   • DImplement a hybrid of controls, using some from NIST SP 800-171 and some from FAR 52.204-21.
   Reveal Solution Discussion Select an answer first