Which code or clause requires that a contractor is meeting the basic safeguarding requirements for FCI during a Level 1 Self-Assessment?
Correct Answer: D
Question 7
Which assessment method describes the process of reviewing, inspecting, observing, studying, or analyzing assessment objects (i.e., specification, mechanisms, activities)?
Correct Answer: A
Question 8
A Lead Assessor is planning an assessment and scheduling the test activities. Who MUST perform tests to obtain evidence?
Correct Answer: A
Understanding Who Must Perform Tests in a CMMC AssessmentDuring aCMMC Level 2 Assessment, assessorsmust observe operational activities and security practicesto verify compliance. This process involves: #Testing security controls and proceduresas part of the assessment. #Observation of standard work practicesto ensure controls are properly implemented. #Using operational personnel (OSC employees) who regularly perform the taskto ensure realistic assessment conditions. Operational personnel (OSC employees) must conduct the actual work while assessors observe. Certified CMMC Professionals (CCPs) or Lead Assessorsoversee and document the testing process. Who Performs Tests? A). OSC personnel who normally perform that work as the CCP observes # Correct CMMC assessments require actual users (OSC personnel) to perform their regular duties while assessors observeto verify security practices. B). Military personnel and the CCP and/or Lead Assessor to test the adequacy of the written procedure(s) # Incorrect Military personnel are not responsible for testing contractor security controls. Assessors observe and evaluate but do not perform testing themselves. C). Military personnel assigned to the contractor for that contract to ensure the confidentiality of the CUI # Incorrect Military personnel do not perform the testing. The contractor (OSC) is responsible for implementing and demonstrating security controls. D). OSC personnel who do not ordinarily perform that work to evaluate the accuracy of the written procedure (s) # Incorrect Personnel unfamiliar with the job should not be used for testing. Theassessment must reflect real-world conditions, so theactual employees who perform the work must demonstrate the process. Why is the Correct Answer "A" (OSC personnel who normally perform that work as the CCP observes)? CMMC Assessment Process (CAP) Document Specifies thatassessments must observe real operational activities to determine compliance. CMMC-AB Assessment Methodology Requirestesting of security controls in a realistic operational environment, meaning actual OSC personnel must perform the tasks. NIST SP 800-171A (Assessment Procedures for NIST SP 800-171) Specifies thatinterviews and observations should be conducted with personnel who regularly perform the work.
Question 9
A CMMC Level 1 Self-Assessment identified an asset in the OSC ' s facility that does not process, store, or transmit FCI. Which type of asset is this considered?
Correct Answer: C
The Cybersecurity Maturity Model Certification (CMMC) 2.0 framework categorizes assets based on their interaction with Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). In a CMMC Level 1 self-assessment, assets are classified based on whether they process, store, or transmit FCI. Asset Categories as per CMMC 2.0: FCI Assets - These assets process, store, or transmit FCI and must meet CMMC Level 1 security requirements (17 practices from FAR 52.204-21). CUI Assets - These assets handle Controlled Unclassified Information (CUI) and are subject to CMMC Level 2 requirements, aligned with NIST SP 800-171. Specialized Assets - Includes IoT devices, Operational Technology (OT), Government-Furnished Equipment (GFE), and test equipment. These are often categorized separately due to their specific cybersecurity requirements. Out-of-Scope Assets - Assets that do not process, store, or transmit FCI or CUI. These do not require compliance with CMMC practices. Government-Issued Assets - These are assets provided by the government for contract-specific purposes, often requiring compliance based on government policies. Why the Correct Answer is C. Out-of-Scope Assets? The question specifies that the identified asset does not process, store, or transmit FCI. According to CMMC 2.0 guidelines, only assets that handle FCI or CUI are subject to security controls. Assets that are physically located within an OSC's facility but do not interact with FCI or CUI fall into the " Out-of-Scope Assets " category. These assets do not require CMMC-specific cybersecurity controls, as they have no impact on the security of FCI or CUI. Relevant CMMC 2.0 References: CMMC Scoping Guide (Nov 2021) - Defines out-of-scope assets as those that are within an OSC's environment but have no interaction with FCI or CUI. CMMC 2.0 Level 1 Guide - Only requires security controls on FCI assets, meaning assets that do not process, store, or transmit FCI are out of scope. CMMC Assessment Process (CAP) Guide - Identifies the classification of assets in an OSC's environment to determine compliance requirements. Final Justification: Since the asset does not process, store, or transmit FCI, it does not fall under " FCI Assets " or " Specialized Assets. " It is also not a government-issued asset. Therefore, the correct classification under CMMC 2.0 is Out-of-Scope Assets (C).
Question 10
Per DoDI 5200.48: Controlled Unclassified Information (CUI), CUI is marked by whom?
Correct Answer: A
Who is Responsible for Marking CUI?According toDoDI 5200.48 (Controlled Unclassified Information (CUI)), the responsibility for marking CUI falls on theauthorized holder of the information. * Definition of an Authorized Holder * PerDoDI 5200.48, Section 3.4, anauthorized holderis anyone who has beengranted accessto CUI and is responsible for handling, safeguarding, and marking it according toDoD CUI policy. * The authorized holder may be: * ADoD employee * Acontractorhandling CUI * Anyorganization or individual authorizedto access and manage CUI * DoD Guidance on CUI Marking Responsibilities * DoDI 5200.48, Section 4.2: * The individual creating or handling CUImust apply the appropriate markings as per the DoD CUI Registry guidelines. * DoDI 5200.48, Section 5.2: * Themarking responsibility is NOT limited to a specific positionlike an Information Disclosure Official or a high-level DoD office. * Instead, it is theresponsibility of the person or entity generating, handling, or disseminatingthe CUI. * Why the Other Answer Choices Are Incorrect: * (A) DoD OUSD (Office of the Under Secretary of Defense): * The OUSD plays apolicy-setting rolebut doesnot directly mark CUI. * (C) Information Disclosure Official: * This role is responsible forpublic release of information, but marking CUI is the duty of theauthorized holdermanaging the data. * (D) Presidential authorized Original Classification Authority (OCA): * OCAs classifynational security information (Confidential, Secret, Top Secret), not CUI, which isnot classified information. Step-by-Step Breakdown:Final Validation from DoDI 5200.48:PerDoDI 5200.48, authorized holders are explicitly responsible for marking CUI, making this the correct answer.
