Cyber AB CMMC-CCA Exam - Topic 3 Question 3 Discussion

Actual exam question for Cyber AB's CMMC-CCA exam

Question #: 3
Topic #: 3

An OSC is preparing for a CMMC assessment. It has multiple information systems, some of which process CUI and others that do not. The OSC has identified a specific system that processes CUI and defined this as its system boundary. However, this system is connected to other systems within the OSC that are separately authorized and do not process CUI. As a Certified CMMC Assessor, which of the following best describes your approach to defining the CMMC Certification Boundary and Assessment Scope for the OSC?

AThe CMMC Certification Boundary and Assessment Scope should include all information systems within the organization, regardless of whether they process CUI or not.

BThe CMMC Certification Boundary and Assessment Scope should only include the specific system that processes CUI and exclude all other systems.

CThe CMMC Certification Boundary should include the specific system that processes CUI, while the Assessment Scope should encompass all systems within the OSC.

DThe CMMC Certification Boundary should include the specific system that processes CUI. In contrast, the Assessment Scope should consist of all components of the information system that require authorization and excludes separately authorized systems to which the information system is connected.

Show Suggested Answer

Suggested Answer: D

Comprehensive and Detailed

The CMMC Assessment Process (CAP) distinguishes the Certification Boundary (the CUI-processing system) from the Assessment Scope (all components needing authorization, excluding separately authorized connected systems). The scoping guide and glossary confirm that separately authorized systems are out of scope, aligning with Option D. Option A is too broad, Option B too narrow, and Option C reverses the definitions. D is correct.

CMMC Assessment Process (CAP) v1.0, Section 2.1 (Certification Boundary), p. 8: 'The Assessment Scope excludes separately authorized systems.'

by Delsie at Oct 07, 2025, 10:57 PM

Limited Time Offer

25%

Off

Get Premium CMMC-CCA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Marta

22 days ago

C is tempting, but it might overlook important links.

upvoted 0 times

...

Selma

27 days ago

I like D as well. It protects the CUI while being realistic.

upvoted 0 times

...

Tracey

2 months ago

B seems too narrow. We need to consider connections.

upvoted 0 times

...

Joanna

2 months ago

I feel like A is too inclusive. We shouldn’t assess everything.

upvoted 0 times

...

Dannie

2 months ago

Option C could work too, but it feels too broad.

upvoted 0 times

...

Quentin

2 months ago

I agree, D is the best choice. It focuses on what’s necessary.

upvoted 0 times

...

Iluminada

2 months ago

B seems too narrow; we need a broader view.

upvoted 0 times

...

Bernadine

2 months ago

Wait, why would we include non-CUI systems? Seems off.

upvoted 0 times

...

Flo

3 months ago

Totally agree with D! It covers all bases.

upvoted 0 times

...

Lynette

3 months ago

I think option D makes the most sense here.

upvoted 0 times

...

Terina

3 months ago

I recall that the certification boundary should be specific to CUI systems, but I’m not clear if the assessment scope should be broader. I might lean towards option D, but I need to think it through.

upvoted 0 times

...

Eleonora

3 months ago

I’m a bit confused about whether we should include all systems in the assessment scope or just the one that processes CUI. I feel like I’ve seen similar questions before.

upvoted 0 times

...

Valentine

3 months ago

I think option D makes sense because it mentions excluding the separately authorized systems, which aligns with what we practiced in class.

upvoted 0 times

...

Ettie

3 months ago

Option D is the way to go. Wouldn't want to miss any critical systems during the assessment. *wink wink*

upvoted 0 times

...

Gilberto

4 months ago

I think option D makes the most sense. It’s clear and precise.

upvoted 0 times

...

Laurene

4 months ago

I remember discussing how the certification boundary should focus on systems that handle CUI, but I'm not sure if we should include all connected systems in the assessment scope.

upvoted 0 times

...

Quentin

4 months ago

D balances everything well. It’s about risk management.

upvoted 0 times

...

Benton

4 months ago

I’m surprised this is even a question—D is clearly the best choice!

upvoted 0 times

...

Isabella

5 months ago

Option D is the way to go. Wouldn't want to miss any critical systems during the assessment.

upvoted 0 times

...

Jose

5 months ago

Option D is the correct answer. Anything less would be a half-baked assessment.

upvoted 0 times

...

Verdell

5 months ago

Option D is the way to go. Gotta make sure the assessment covers all the right components.

upvoted 0 times

...

Earlean

5 months ago

I agree, Option D is the best choice as it aligns with the CMMC guidance on system boundaries.

upvoted 0 times

...

Fatima

5 months ago

Option D seems the most comprehensive approach to defining the CMMC Certification Boundary and Assessment Scope.

upvoted 0 times

...

Luis

6 months ago

Okay, I've got this. The certification boundary is just for the CUI-processing system itself, but the assessment scope needs to look at all the parts of that system that are in scope, even if they connect to other systems that aren't part of the certification. Separating the boundary and scope is important to make sure you're assessing everything that's relevant.

upvoted 0 times

...

Bobbie

6 months ago

I think D is the best answer here. The key is that the certification boundary is just for the specific CUI-processing system, but the assessment scope needs to be broader to cover all the components of that system. Gotta make sure you're assessing everything that's part of the CUI-handling system, even if it's connected to other systems.

upvoted 0 times

...

Gerald

6 months ago

Hmm, I'm a bit confused on this one. I'm not sure if I fully understand the difference between the certification boundary and the assessment scope. I'll need to review the CMMC guidelines more carefully to make sure I'm clear on the right approach.

upvoted 0 times

...

Vivienne

6 months ago

I'm pretty sure the answer is D. The certification boundary should only include the specific system that processes CUI, while the assessment scope should cover all the components of that system that require authorization, excluding any separately authorized systems it's connected to.

upvoted 0 times