Cyber AB CMMC-CCA Exam - Topic 4 Question 1 Discussion

Actual exam question for Cyber AB's CMMC-CCA exam

Question #: 1
Topic #: 4

SecureNet is a mid-sized company that designs and manufactures access control systems for government buildings. These systems utilize Internet of Things (IoT) devices embedded within the access control panels for real-time remote monitoring. SecureNet is undergoing a CMMC Level 2 assessment to comply with new government contracting requirements. During the scope validation stage, the Certified CMMC Assessor (CCA) will review SecureNet's proposed assessment scope with the IT team. The scope includes all servers, workstations, and laptops within SecureNet's network. However, there is no mention of the IoT devices within the access control panels. Which of the following asset categories is most likely to encompass the in-scope IoT devices used in SecureNet's access control systems?

ASecurity Protection Asset (SPA)

BSpecialized Assets

CHardware Assets

DContractor Risk Managed Asset (CRMA)

Show Suggested Answer

Suggested Answer: B

Comprehensive and Detailed

IoT devices in access control panels are Specialized Assets per the CMMC Assessment Scope - Level 2, as they are non-standard equipment tied to contract performance. They may process or transmit CUI-related data (e.g., security monitoring), making them in scope, but they don't inherently provide security functions (Option A) or fit as CRMAs (Option D). ''Hardware Assets'' (Option C) is not a CMMC category. B is correct, and the IoT devices should be added to the scope.

CMMC Assessment Scope - Level 2, Section 2.3.4 (Specialized Assets), p. 6: 'IoT devices are Specialized Assets.'

by Salome at Oct 01, 2025, 10:53 AM

Limited Time Offer

25%

Off

Get Premium CMMC-CCA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Estrella

2 months ago

I’m surprised they didn’t mention the IoT devices in the scope at all.

upvoted 0 times

...

Jenifer

2 months ago

Wait, are we sure they’re not considered Hardware Assets?

upvoted 0 times

...

Gaston

2 months ago

I'm pretty sure the IoT devices fall under Specialized Assets.

upvoted 0 times

...

Jacqueline

3 months ago

Agreed, they’re not just regular hardware.

upvoted 0 times

...

Pansy

3 months ago

Definitely Specialized Assets, no doubt about it!

upvoted 0 times

...

Merrilee

3 months ago

I lean towards Security Protection Asset since these devices are crucial for security, but I don't recall if that category applies to IoT specifically.

upvoted 0 times

...

Mari

3 months ago

I'm a bit confused about the categories. I thought specialized assets were for unique systems, but I also see how they could be considered hardware assets.

upvoted 0 times

...

France

4 months ago

I think the question is similar to one we practiced where we had to categorize different types of assets. I feel like hardware assets might be the right choice since IoT devices are physical components.

upvoted 0 times

...

Elke

4 months ago

I remember discussing how IoT devices can sometimes fall under specialized assets, but I'm not entirely sure if that's the best fit here.

upvoted 0 times

...

Elmira

4 months ago

Okay, I think I've got it. The IoT devices are hardware components that are part of the access control system, so "Hardware Assets" is the most likely category.

upvoted 0 times

...

Luisa

4 months ago

Hmm, I'm a bit confused. Since the IoT devices are part of the contractor's (SecureNet's) network, maybe "Contractor Risk Managed Asset" is the right answer?

upvoted 0 times

...