Understand CMMC High-Level Scoping as Described in the CMMC Assessment Process CCP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An assessor is conducting high-level scoping for a CMMC assessment. The organization has identified CUI assets, security protection assets, and contractor risk managed assets. What is the next step in the scoping process?

   • ADefine the assessment scope based on the identified assets.
   • BDetermine which assets are in scope based on their categorization.
   • CDocument the scoping decisions and rationale.
   • DIdentify where CUI is stored, processed, or transmitted.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which asset category includes systems that provide security functions to protect CUI, such as firewalls and intrusion detection systems?

   • ASecurity protection assets
   • BContractor risk managed assets
   • CSpecialized assets
   • DCUI assets
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A CMMC assessor is explaining the purpose of scoping to a client. The client asks, 'Why do we need to define the assessment scope?' What is the primary reason?

   • ATo identify all assets in the organization, regardless of CUI involvement.
   • BTo determine the organization's CMMC level.
   • CTo create a detailed inventory of all hardware and software.
   • DTo determine the boundaries of the assessment and focus on assets that handle CUI.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An organization has a network that includes CUI assets and non-CUI assets. The network is protected by a firewall that does not process CUI. The organization also uses a cloud-based email service that transmits CUI. How should the firewall and cloud email service be categorized?

   • AFirewall as CUI asset; cloud email as security protection asset.
   • BBoth as CUI assets.
   • CBoth as security protection assets.
   • DFirewall as security protection asset; cloud email as CUI asset.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is unsure where CUI resides in its environment. The assessor begins high-level scoping. What is the first step the assessor should take?

   • ACategorize assets as CUI, security protection, or contractor risk managed.
   • BDocument scoping decisions.
   • CDefine the assessment scope.
   • DIdentify where CUI is stored, processed, or transmitted.
   Reveal Solution Discussion Select an answer first