Understand CMMC High-Level Scoping as Described in the CMMC Assessment Process CCP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   After completing high-level scoping for a CMMC assessment, the assessor must produce documentation. What should the documentation include?

   • AA copy of the organization's CMMC implementation plan.
   • BA detailed network diagram of the entire organization.
   • CA description of the assessment scope and the rationale for scoping decisions.
   • DA list of all assets in the organization, including non-CUI assets.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An assessor is conducting high-level scoping for a CMMC assessment. The organization has a mix of CUI assets, security protection assets, and contractor risk managed assets. What is the correct sequence of steps in the scoping process?

   • ADefine scope, identify assets, categorize assets, document decisions.
   • BIdentify assets, categorize assets, define scope, document decisions.
   • CDocument decisions, identify assets, categorize assets, define scope.
   • DCategorize assets, identify assets, document decisions, define scope.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the first step in the high-level scoping process as described in the CMMC Assessment Process?

   • AIdentify all assets that store, process, or transmit CUI
   • BCategorize assets into CUI, security protection, and contractor risk managed
   • CDefine the assessment boundary
   • DDocument the scoping decisions
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When defining the assessment scope, why is it important to consider cloud service providers?

   • ABecause cloud providers determine the CMMC level
   • BBecause cloud providers are always out of scope
   • CBecause cloud providers may store, process, or transmit CUI on behalf of the organization
   • DBecause cloud providers are always in scope
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An assessor is conducting high-level scoping for a CMMC assessment. The organization has a complex environment with multiple facilities and remote workers. The assessor must balance the need for a thorough assessment with the cost of assessing every asset. What is the most effective approach?

   • AUse a sampling approach to assess a subset of assets.
   • BFocus the assessment on assets that handle CUI and security protection assets.
   • CAssess only the main facility and exclude remote workers.
   • DAssess every asset in the organization to ensure no CUI is missed.
   Reveal Solution Discussion Select an answer first