Understand CMMC High-Level Scoping as Described in the CMMC Assessment Process CCP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following should be included in scoping documentation?

   • AThe organization's marketing strategy
   • BThe names of all employees in the organization
   • CThe organization's financial statements
   • DThe rationale for including or excluding assets from the assessment scope
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A small manufacturing firm that handles CUI uses a cloud-based ERP system to manage contracts and store CUI. The firm also allows employees to access the ERP from personal mobile devices. During high-level scoping, what should the assessor consider regarding the cloud ERP and mobile devices?

   • AThe cloud ERP is outside the assessment scope because it is a third-party service.
   • BThe cloud ERP and personal mobile devices are both in scope because they store, process, or transmit CUI.
   • CThe cloud ERP is in scope, but personal mobile devices are out of scope because they are not company-owned.
   • DThe cloud ERP is in scope, but only if the firm has a formal cloud agreement with the provider.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In the CMMC assessment process, what does scoping determine?

   • AThe specific security requirements that will be tested
   • BThe overall CMMC level the organization should achieve
   • CThe number of assessors required for the assessment
   • DThe boundaries of the assessment, including which assets and systems are included
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company uses a cloud-based customer relationship management (CRM) system that stores CUI. The company also has an on-premises database that does not contain CUI. During scoping, what should the assessor do?

   • AExclude the cloud CRM because it is a third-party service.
   • BInclude both the cloud CRM and the on-premises database in the assessment scope.
   • CInclude the on-premises database because it is on-premises.
   • DInclude the cloud CRM in the assessment scope and exclude the on-premises database.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of scoping in the CMMC assessment process?

   • ATo determine which security controls are required for the organization
   • BTo define the boundaries of the assessment by identifying which assets and systems are in scope
   • CTo assign a CMMC level to the organization
   • DTo select the assessment team members
   Reveal Solution Discussion Select an answer first