Understand CMMC High-Level Scoping as Described in the CMMC Assessment Process CCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a scoping consideration when mobile devices are used to access CUI?

   • AMobile devices are always in scope
   • BMobile devices are always out of scope
   • CMobile devices may be in scope if they store, process, or transmit CUI
   • DMobile devices are considered only if they are company-owned
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of identifying where CUI is transmitted?

   • AReviewing the organization's marketing materials
   • BReviewing the organization's CMMC level
   • CReviewing network diagrams to identify data flows
   • DReviewing the assessment team's qualifications
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large organization has multiple business units, some of which handle CUI and others that do not. The organization wants to minimize the assessment scope to reduce cost and effort. What is the most appropriate approach?

   • AInclude only the business units that handle CUI, excluding all shared infrastructure.
   • BInclude all business units in the assessment scope to ensure compliance.
   • CExclude business units that do not handle CUI, but include shared infrastructure that supports CUI-handling units.
   • DExclude all shared infrastructure to minimize scope.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which asset category includes assets that are managed by an external provider and may store, process, or transmit CUI?

   • AOutsourced assets
   • BContractor risk managed assets
   • CCUI assets
   • DSecurity protection assets
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of documenting scoping decisions in the CMMC assessment process?

   • ATo list all security controls implemented
   • BTo determine the CMMC level
   • CTo provide a record of the rationale for what is included in the assessment scope
   • DTo replace the need for a formal assessment
   Reveal Solution Discussion Select an answer first