800-171 Practice Test

800-171 practice test: what's covered

• CUI
• NIST SP 800-171
• Assessment
• POA&M
• SPRS
• Evidence
• Scope

Free 800-171 sample questions

1. A security engineer needs to determine which systems must meet CMMC Level 2 requirements during a controlled production rollout. Which response is the BEST fit?

   • A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — with change evidence recorded
   • B. assume corporate marketing laptops are always out of scope without review — with change evidence recorded
   • C. scope only the physical headquarters building and ignore cloud SaaS — with change evidence recorded
   • D. exclude any system that uses encryption of any kind — with change evidence recorded
   Show answer

   Correct: A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — with change evidence recorded is the best answer because CUI flow determines the assessment boundary more than org charts alone. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes CUI data map, asset inventory, and boundary diagram.

2. An administrator must determine which systems must meet CMMC Level 2 requirements while investigating an urgent support case. Which action should be taken first?

   • A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — after confirming scope and ownership
   • B. assume corporate marketing laptops are always out of scope without review — after confirming scope and ownership
   • C. scope only the physical headquarters building and ignore cloud SaaS — after confirming scope and ownership
   • D. exclude any system that uses encryption of any kind — after confirming scope and ownership
   Show answer

   Correct: A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — after confirming scope and ownership is the best answer because CUI flow determines the assessment boundary more than org charts alone. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes CUI data map, asset inventory, and boundary diagram.

3. A company plans to determine which systems must meet CMMC Level 2 requirements during an audit-readiness review. Which design best meets the requirement?

   • A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — using the vendor-supported workflow
   • B. assume corporate marketing laptops are always out of scope without review — using the vendor-supported workflow
   • C. scope only the physical headquarters building and ignore cloud SaaS — using the vendor-supported workflow
   • D. exclude any system that uses encryption of any kind — using the vendor-supported workflow
   Show answer

   Correct: A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — using the vendor-supported workflow is the best answer because CUI flow determines the assessment boundary more than org charts alone. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes CUI data map, asset inventory, and boundary diagram.

4. During troubleshooting, the team must determine which systems must meet CMMC Level 2 requirements after a regional service change. Which next step is most defensible?

   • A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — with least privilege preserved
   • B. assume corporate marketing laptops are always out of scope without review — with least privilege preserved
   • C. scope only the physical headquarters building and ignore cloud SaaS — with least privilege preserved
   • D. exclude any system that uses encryption of any kind — with least privilege preserved
   Show answer

   Correct: A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — with least privilege preserved is the best answer because CUI flow determines the assessment boundary more than org charts alone. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes CUI data map, asset inventory, and boundary diagram.

5. An administrator needs to determine which systems must meet CMMC Level 2 requirements before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — with monitoring and rollback defined
   • B. verify the result using CUI data map, asset inventory, and boundary diagram — with monitoring and rollback defined
   • C. assume corporate marketing laptops are always out of scope without review — with monitoring and rollback defined
   • D. scope only the physical headquarters building and ignore cloud SaaS — with monitoring and rollback defined
   • E. exclude any system that uses encryption of any kind — with monitoring and rollback defined
   Show answer

   Correct: A and B. define the CUI inventory and assessment boundary based on where CUI is processed, stored, or transmitted — with monitoring and rollback defined and verify the result using CUI data map, asset inventory, and boundary diagram — with monitoring and rollback defined are correct because CUI flow determines the assessment boundary more than org charts alone. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this CMMC Level 2 scenario.

Last updated: 2026-10-19

800-171 practice test FAQ