The best resource for identifying the category of Controlled Unclassified Information (CUI) is NARA , because NARA is the CUI Executive Agent for the federal CUI Program and maintains the authoritative CUI Registry . The Registry is specifically where the government publishes the approved CUI categories (and related markings and handling guidance) used across the Executive Branch.
NARA's own CUI FAQs explicitly point users to the CUI Registry as the place that "lists all authorized CUI Categories (basic and specified)." Likewise, NIST's CUI-related FAQ page also points to the NARA CUI Registry for CUI categories, reinforcing that the Registry is the correct source for determining which category applies to a given type of information.
By contrast, DFARS Part 252 (including clauses like 252.204-7012) addresses contractual safeguarding and cyber reporting requirements, not the authoritative categorization list itself. The CMMC Assessment Guide is about how to assess controls for CMMC levels, not how to determine CUI categories. And the Cyber AB (formerly CMMC-AB) administers the ecosystem and assessment processes, not the federal CUI category taxonomy. Therefore, NARA is the best answer.

How Many Practices Are Included in CMMC Level 2?
CMMC Level 2is designed to alignfullywithNIST SP 800-171, which consists of110 security controls (practices).
This meansall 110 practicesfrom NIST SP 800-171 are required for aCMMC Level 2 certification.
Breakdown of Practices in CMMC 2.0
CMMC Level
Number of Practices
Level 1
17 practices(Basic Cyber Hygiene)
Level 2
110 practices(Aligned with NIST SP 800-171)
Level 3
Not yet finalized but expected to exceed 110
Since CMMC Level 2 mandatesall 110 NIST SP 800-171 practices, the correct answer isC. 110 practices.
Why the Other Answers Are Incorrect
A). 17 practices
#Incorrect.17 practicesapply only toCMMC Level 1, not Level 2.
B). 72 practices
#Incorrect. There is no CMMC level with72 practices.
D). 180 practices
#Incorrect. CMMC Level 2only requires 110 practices, not 180.
CMMC Official References
CMMC 2.0 Model- Confirms thatLevel 2 includes 110 practicesaligned withNIST SP 800-171.
NIST SP 800-171 Rev. 2- Outlines the110 security controlsrequired for handlingControlled Unclassified Information (CUI).
Thus,option C (110 practices) is the correct answer, as per official CMMC guidance.

According to the CMMC Scoping Guidance, Level 1, the categorization of assets is much simpler than at Level 2. At Level 1, there are only two primary categories for assets within the Organization Seeking Certification (OSC): In-Scope Assets (FCI Assets) and Out-of-Scope Assets.
FCI Asset Definition: An asset is considered "In-Scope" for Level 1 if it processes, stores, or transmits Federal Contract Information (FCI). Since the company is building specialized parts under a DoD contract and using in-house staff and equipment for testing, the information related to that contract (the specifications, schedules, and test results) constitutes FCI.
The Level 1 Universe:
Level 1 does not use the complex sub-categories found in Level 2 scoping, such as "Specialized Assets" (OT
/IoT/Test Equipment) or "Contractor Risk Managed Assets." Those distinctions are specific to CMMC Level
2 Scoping.
In a Level 1 environment, any piece of equipment or software that handles the contract's information is simply termed an FCI Asset, which falls under the broader umbrella of In-Scope Assets.
Why other options are incorrect:
Option A (CUI Asset): Level 1 is focused exclusively on FCI. CUI (Controlled Unclassified Information) is the focus of Level 2 and Level 3.
Option C (Specialized Asset) and Option D (Contractor Risk Managed Asset): These are specific scoping categories defined in the CMMC Level 2 Scoping Guidance. In Level 1, these categories do not exist; an asset either handles FCI (In-Scope) or it does not (Out-of-Scope).
Reference Documents:
CMMC Scoping Guidance, Level 1 (Version 2.0): Section 2.0 (CMMC Level 1 Asset Categories), which defines FCI Assets and Out-of-Scope Assets.
32 CFR Part 170 (CMMC Program Rule): Establishes the simplified scoping requirements for Level 1 self- assessments.
CMMC Level 1 Assessment Guide: Clarifies that the scope includes all "information systems" (including test equipment) used by the contractor to process, store, or transmit FCI.

The CMMC Assessment Process uses three methods: Examine, Interview, and Test. The method that involves analyzing artifacts (documents, system configurations, records, logs, etc.) is Examine.
Supporting Extracts from Official Content:
* CMMC Assessment Guide: "Examine consists of reviewing, inspecting, or analyzing assessment objects such as documents, system configurations, or other artifacts to evaluate compliance." Why Option B is Correct:
* Examine = analyzing artifacts.
* Interview = discussions with personnel.
* Test = executing technical checks.
* Behavior is not an assessment method.
References (Official CMMC v2.0 Content):
* CMMC Assessment Guide, Levels 1 and 2 - Assessment Methods (Examine, Interview, Test).

Per DoDI 5200.48, Controlled Unclassified Information (CUI), the minimum marking requirement is that the word "CUI" must appear in the header and footer of each page of a document containing CUI. Additional markings such as portion markings or cover sheets may be applied depending on the situation, but the minimum baseline requirement is header and footer placement of "CUI".
Reference Documents:
DoDI 5200.48,Controlled Unclassified Information (CUI)