After identifying assets that handle CUI, what is the next step in the high-level scoping process?

Categorize the assets into CUI, security protection, and contractor risk managed

A company that produces military components has CUI spread across several systems: an on-premises file server, a cloud-based collaboration tool, and email. The company also has a legacy system that is being decommissioned but still contains CUI. During scoping, what should the assessor do with the legacy system?

Exclude it because it is being decommissioned.

Include it in the assessment scope because it contains CUI.

Exclude it because it is a legacy system.

Include it only if it is connected to the network.

A company is preparing for a CMMC assessment and has limited budget. The company wants to minimize the assessment scope without compromising compliance. What is the most effective strategy?

Exclude security protection assets to reduce scope.

Include only CUI assets, excluding all other assets.

Include all assets that handle CUI and security protection assets.

Use a sampling approach to assess a subset of assets.

Why is it important to identify where CUI is stored, processed, or transmitted during scoping?

To identify which security controls are applicable

To determine the number of assessors needed

To ensure all relevant assets are included in the assessment scope

To determine the CMMC level required for the organization

CMMC Certified Professional

Domain 6Objective 1

Understand CMMC High-Level Scoping as Described in the CMMC Assessment Process CCP Practice Questions (Page 4)

Part of the Scoping domain, which accounts for 15% of the CCP exam.

26questions here

6free pages

6concepts

15%of the exam

Questions 16–20

16application · medium
An organization has a server that hosts a database containing CUI. The server is also used for non-CUI applications. How should this server be categorized?
Select an answer first
17foundation · easy
After identifying assets that handle CUI, what is the next step in the high-level scoping process?
Select an answer first
18application · medium
A company that produces military components has CUI spread across several systems: an on-premises file server, a cloud-based collaboration tool, and email. The company also has a legacy system that is being decommissioned but still contains CUI. During scoping, what should the assessor do with the legacy system?
Select an answer first
19expert · hard
A company is preparing for a CMMC assessment and has limited budget. The company wants to minimize the assessment scope without compromising compliance. What is the most effective strategy?
Select an answer first
20foundation · easy
Why is it important to identify where CUI is stored, processed, or transmitted during scoping?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCP” is a trademark of its owner, used for identification only.

Understand CMMC High-Level Scoping as Described in the CMMC Assessment Process CCP Practice Questions (Page 4)

Questions 16–20

An organization has a server that hosts a database containing CUI. The server is also used for non-CUI applications. How should this server be categorized?

After identifying assets that handle CUI, what is the next step in the high-level scoping process?

A company is preparing for a CMMC assessment and has limited budget. The company wants to minimize the assessment scope without compromising compliance. What is the most effective strategy?

Why is it important to identify where CUI is stored, processed, or transmitted during scoping?

Keep studying — Scoping