Cyber AB Updated CMMC-CCP Exam Questions and Answers by nikola

This question deals withasset categorizationduring aCMMC Level 1 Self-Assessment. The organization is manufacturingspecialized partsfor the DoD, butLevel 1of CMMC only concernsFederal Contract Information (FCI)—notControlled Unclassified Information (CUI). Therefore, asset categorization should follow theCMMC Scoping Guidance for Level 1.

✅Step 1: Understand CMMC Level 1 and FCI

Level 1 Objective:

Implement basic safeguarding requirements as perFAR 52.204-21.

Applies to systems thatstore, process, or transmit FCI.

Self-assessments are permitted and required annually.

Source Reference:

CMMC Scoping Guidance – Level 1 (v1.0)

https://dodcio.defense.gov/CMMC

✅Step 2: What is an “In-scope Asset”?

CMMC Scoping Guidance – Level 1definesIn-scope assetsas:

“Assets that process, store, or transmit FCI or provide security protection for such assets.”

In this scenario:

The machining company isperforming contract work(manufacturing DoD parts).

Thetesting is done internally, implying the systems and equipment used in testing and documentation aredirectly supporting the contract.

These systems likely handleFCIsuch as technical specifications, purchase orders, or test reports.

➡️Therefore, the equipment and systems used in testing are consideredIn-scope Assetsunder Level 1.

❌Why the Other Options Are Incorrect

A. CUI Asset

✘Incorrect forLevel 1:

CUI is only in scope atCMMC Level 2 and Level 3.

Level 1 is concerned withFCI, not CUI.

C. Specialized Asset

✘Incorrect definition:

Specialized assets(defined inCMMC Level 2 Scoping) include IoT, OT, ICS, GFE, and similar types of non-enterprise assets that may require alternative treatment.

This classification isnot used in Level 1 Scoping.

D. Contractor Risk Managed Asset

✘Incorrect:

Also defined underCMMC Level 2 Scopingonly.

These are assets that are not security-protected but are managed via risk-based decisions.

This term isnot applicableforCMMC Level 1 assessments.

✅Step 3: Alignment with Official Documentation

According to theCMMC Scoping Guidance for Level 1:

“The assets within the self-assessment scope are those that process, store, or transmit FCI. These assets are considered ‘in-scope.’”

No other asset categorization (such as CUI asset, specialized asset, or contractor risk managed asset) is used atLevel 1.

BLUF (Bottom Line Up Front):

For aCMMC Level 1 Self-Assessment, theonlyasset category officially recognized is theIn-scope Asset— any asset that handles or protects FCI. Since the company's internal testing operations are part of fulfilling the DoD contract, the systems and staff involved arein scope.

Understanding the Definition of an Agreement in the CMMC-AB Code of Professional ConductTheCMMC-AB Code of Professional Conductdefines anagreementasany contract between two legal entities. This includes:

✔Contracts between an OSC and a C3PAOfor CMMC assessments.

✔Service agreements between cybersecurity providers and defense contractors.

✔Any formal, legally binding arrangement related to CMMC compliance.

A. Union → Incorrect

Auniontypically refers to anorganization representing workersand is not used to describe acontractual relationship.

B. Accord → Incorrect

While anaccordcan mean an agreement, it isnot the standard legal term for a binding contractin CMMC documentation.

C. Alliance → Incorrect

Analliancerefers to astrategic partnership, but does not necessarily imply alegally binding contract.

D. Agreement → Correct

TheCMMC-AB Code of Professional Conductdefines anagreementas anylegally binding contract between two entities.

Why is the Correct Answer "D. Agreement"?

CMMC-AB Code of Professional Conduct

Defines"Agreement"as alegally binding contract between two parties.

CMMC-AB Licensed Training and Assessment Provider Guidelines

Requires that all engagementsbe governed by a formal agreement (contract) between the parties.

DFARS and CMMC Certification Contracts

States thatOSC-C3PAO relationships must be formalized through a legal agreement.

CMMC 2.0 References Supporting This Answer:

ACertified CMMC Professional (CCP)advising anOrganization Seeking Certification (OSC)must ensure thatFederal Contract Information (FCI)andControlled Unclassified Information (CUI)are properly documented within required security documents.

Step-by-Step Breakdown:✅1. System Security Plan (SSP)

CMMC Level 2requires anSSPto documenthow CUI is protected, including:

Security controlsimplemented

Asset categorization(CUI Assets, Security Protection Assets, etc.)

Policies and proceduresfor handling CUI

✅2. Asset Inventory

Anasset inventorylistsall relevant IT systems, applications, and hardwarethat store, process, or transmitCUI or FCI.

TheCMMC Scoping Guiderequires OSCs to identifyCUI-relevant assetsas part of their compliance.

✅3. Network Diagram

Anetwork diagramvisually representshow data flows across systems, showing:

WhereCUI is transmitted and stored

Security boundaries protectingCUI Assets

Connectivity betweenCUI Assets and Security Protection Assets

✅4. Why the Other Answer Choices Are Incorrect:

(B) Within the hardware inventory, data flow diagram, and in the network diagram❌

While adata flow diagramis useful,hardware inventory alone is insufficientto document CUI.

(C) Within the asset inventory, in the proposal response, and in the network diagram❌

Aproposal responseis not a required document for CMMC assessments.

(D) In the network diagram, in the SSP, within the base inventory, and in the proposal response❌

Base inventoryis not a specific CMMC documentation requirement.

TheCMMC Assessment Guideconfirms that FCI and CUI must be documented in:

The SSP

The asset inventory

The network diagram

Final Validation from CMMC Documentation:Thus, the correct answer is:

✅A. "In the SSP, within the asset inventory, and in the network diagram."

Does a File Cabinet Containing Paper FCI Fall Within CMMC Scope?CMMConly applies to digital systems and assetsthatprocess, store, or transmitFederal Contract Information (FCI)andControlled Unclassified Information (CUI).Physical storage (such as paper documents) is not included in CMMC scoping.

Step-by-Step Breakdown:✅1. CMMC Scope Covers Only Digital Systems and Assets

According to theCMMC Scoping Guide (Level 1),only digital assetsthat handleFCIarein scopefor aLevel 1 Self-Assessment.

Afile cabinetisnot a digital system; therefore, it isnot in scopefor CMMC compliance.

✅2. Why the Other Answer Choices Are Incorrect:

(A) In scope, because it is an asset that stores FCI❌

Incorrect:While the file cabinetdoes store FCI,CMMC only applies to digital systems.

(B) In scope, because it is part of the same physical location❌

Incorrect:CMMCdoes notconsiderphysical proximitywhen determining scope—only digital data handling matters.

(D) Out of scope, because it does not process or transmit FCI❌

Partially correct, but incomplete: Themain reasonit is out of scope is that itcontains only paper documents, not that it doesn’t process/transmit data.

TheCMMC Level 1 Scoping Guideexplicitly states thatpaper-based storage of FCI does not fall within scope.

Final Validation from CMMC Documentation:Thus, the correct answer is:

✅C. Out of scope, because they are all only paper documents.