Exam CMMC-CCA Topic 3 Question 94 Discussion
Actual exam question for Cyber AB's CMMC-CCA exam
Question #: 94
Topic #: 3
Question #: 94
Topic #: 3
Both FCI and CUI are stored by an OSC on the same network. Server A contains file shares with FCI, and Server B contains file shares with CUI. The OSC hopes each server would only undergo the assessment for the classification of data it contains. What is the MOST correct assessment situation in this scenario?
Suggested Answer: A Vote an answer
When CUI and FCI reside on the same network, the entire environment is considered a CUI environment.
The presence of CUI drives the assessment requirement to CMMC Level 2, regardless of whether FCI also exists. Assets cannot be assessed separately under Level 1 vs. Level 2 within the same network boundary.
Exact extracts:
* "If CUI is processed, stored, or transmitted within an environment, the environment is in scope for CMMC Level 2."
* "The presence of CUI dictates the assessment level, regardless of whether FCI is also present."
* "Segmentation may reduce scope, but if assets remain within the same environment, all assets fall under Level 2." Why other options are incorrect:
* B: Level 1 cannot be applied to Server A while Server B undergoes Level 2 in the same network.
* C: Presence of CUI means Level 2 is required, not Level 1.
* D: Segmentation can reduce scope but is not required before assessment; it is an OSC design choice.
References:
CMMC Scoping Guide - Level 2 (FCI vs. CUI environments).
CMMC Assessment Guide - Applicability of Level 1 vs. Level 2.
The presence of CUI drives the assessment requirement to CMMC Level 2, regardless of whether FCI also exists. Assets cannot be assessed separately under Level 1 vs. Level 2 within the same network boundary.
Exact extracts:
* "If CUI is processed, stored, or transmitted within an environment, the environment is in scope for CMMC Level 2."
* "The presence of CUI dictates the assessment level, regardless of whether FCI is also present."
* "Segmentation may reduce scope, but if assets remain within the same environment, all assets fall under Level 2." Why other options are incorrect:
* B: Level 1 cannot be applied to Server A while Server B undergoes Level 2 in the same network.
* C: Presence of CUI means Level 2 is required, not Level 1.
* D: Segmentation can reduce scope but is not required before assessment; it is an OSC design choice.
References:
CMMC Scoping Guide - Level 2 (FCI vs. CUI environments).
CMMC Assessment Guide - Applicability of Level 1 vs. Level 2.
by Nora at Sep 23, 2025, 04:52 AM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).