CMMC Certified Professional (CCP)

Last checked November 10, 2026 against the official ISACA exam page.

1. Question 1CMMC Ecosystem

   A defense contractor asks which organization in the CMMC ecosystem is authorized to accredit third-party assessment organizations and oversee the credentialing of individual assessors. Which organization should the contractor name?

   1. ADefense Contract Management Agency, which conducts routine certification assessments for every contractor
   2. BThe Cyber AB, the accreditation body that authorizes C3PAOs and oversees individual credentialing
   3. CThe contractor's own senior official, who appoints assessors and issues the certification
   4. DNational Institute of Standards and Technology, which trains and credentials every individual assessor
   Show answer and explanationHide answer

   Correct answer: B

   The Cyber AB accredits C3PAOs and oversees the training and credentialing of individual assessors. DCMA does not accredit organizations, the contractor's senior official affirms compliance rather than certifying it, and NIST publishes standards rather than credentialing assessors.

2. Question 2CMMC-AB Code of Professional Conduct (Ethics)

   A CCP helped a contractor write its System Security Plan and documented controls during a consulting engagement. Later, the CCP is asked to join the assessment team for the same contractor. What should the CCP do?

   1. AAccept the assignment, since the earlier work covered a different scope than the one being assessed now
   2. BAccept the assignment only after the contractor has already received its certification decision
   3. CAccept the assignment but keep the earlier consulting relationship out of the assessment report
   4. DDisclose the prior consulting relationship and decline the assessment role to preserve objectivity
   Show answer and explanationHide answer

   Correct answer: D

   An assessor who helped build the controls has a conflict of interest and cannot judge them objectively, so the relationship must be disclosed and the assessment role declined. Accepting and hiding the relationship, or waiting until after the decision, does not remove the conflict.

3. Question 3CMMC Governance and Source Documents

   A compliance officer is drafting a policy and needs the federal rule that establishes the CMMC Program itself. Which citation should the officer reference?

   1. A32 CFR Part 2002
   2. B29 CFR Part 1910
   3. C32 CFR Part 170
   4. D40 CFR Part 170
   Show answer and explanationHide answer

   Correct answer: C

   32 CFR Part 170 is the CMMC Program rule. 32 CFR Part 2002 governs the CUI program rather than CMMC certification, and the other two citations belong to unrelated regulatory areas.

4. Question 4CMMC Model Construct and Implementation Evaluation

   Which CMMC level applies to organizations that handle only Federal Contract Information (FCI)?

   1. ALevel 2 (Advanced), which protects CUI with practices aligned to NIST SP 800-171
   2. BLevel 3 (Expert), which protects CUI against advanced persistent threats
   3. CLevel 1 (Foundational), which protects FCI with a basic set of practices
   4. DLevel 0 (Basic), which is a self-declared tier with no formal practices
   Show answer and explanationHide answer

   Correct answer: C

   Level 1 (Foundational) protects FCI with a basic set of practices and an annual self-assessment. Level 2 and Level 3 protect CUI, and the CMMC model has no formal Level 0.

5. Question 5CMMC Assessment Process (CAP)

   An assessment team needs to decide whether a Level 2 practice is actually implemented. Which set of assessment methods, defined in NIST SP 800-171A, should the team use to collect evidence?

   1. AAudit the policy, certify the operations, and recertify each year
   2. BScan the network, patch the findings, and report the results
   3. CPlan the controls, design the architecture, and deploy the tools
   4. DExamine, interview, and test
   Show answer and explanationHide answer

   Correct answer: D

   NIST SP 800-171A defines examine, interview, and test as the assessment methods for gathering evidence. The other options describe operational or management activities performed on the system, not assessment methods.