Free CMMC Certified Professional (CCP) practice test: 30 questions with answers

The Cyber AB accredits C3PAOs and oversees the training and credentialing of individual assessors. DCMA does not accredit organizations, the contractor's senior official affirms compliance rather than certifying it, and NIST publishes standards rather than credentialing assessors.

C3PAOs conduct certification assessments, RPOs provide advice without performing the assessment for the same client, and the Cyber AB accredits and credentials. Accounts payable and a printing vendor are not defined CMMC ecosystem roles.

DFARS 252.204-7012 requires cloud service providers that store CUI for a contractor to meet the FedRAMP Moderate baseline or an equivalent standard. The other options invent a certification requirement, remove any requirement, or wrongly exempt the provider because of data ownership.

A Registered Provider Organization gives advice and consulting, and it cannot act as the assessor for the same client. An Organization Seeking Certification is the contractor being assessed, a C3PAO performs the formal assessment, and DIBCAC is a government body rather than a consulting provider.

DCMA's DIBCAC conducts the government-led assessments for Level 3. The Cyber AB accredits and credentials rather than assessing, an internal audit group is not a government-led assessor, and a C3PAO is a third-party assessor rather than a government body.

An assessor who helped build the controls has a conflict of interest and cannot judge them objectively, so the relationship must be disclosed and the assessment role declined. Accepting and hiding the relationship, or waiting until after the decision, does not remove the conflict.

Honest and accurate representation of credentials and certification status is a core professional conduct expectation. Using a logo without checking currency, promising results, or implying a higher level all misrepresent the professional's standing.

Assessment findings must rest on objective evidence, and pressure to change them is an integrity issue that should be escalated through the proper channels. Changing, hiding, or outsourcing the sign-off of findings would all compromise the assessment.

Client information gathered during an engagement must be protected and shared only as the rules and the engagement allow. Posting evidence publicly, keeping artifacts on personal devices, or discussing a client's gaps with competitors all breach confidentiality.

Certification outcomes depend on the evidence and on an independent assessment, so ethical consultants do not guarantee a result. The other responses either promise an outcome or tie a promise to fees or to hidden contract terms.

32 CFR Part 170 is the CMMC Program rule. 32 CFR Part 2002 governs the CUI program rather than CMMC certification, and the other two citations belong to unrelated regulatory areas.

DFARS 252.204-7021 is the clause that carries the CMMC level requirement into contracts. DFARS 252.204-7012 covers safeguarding and incident reporting, FAR 52.204-21 sets basic safeguarding requirements, and FAR 52.203-13 addresses ethics, so none of those is the CMMC requirement clause.

Level 2 practices are drawn from NIST SP 800-171, and NIST SP 800-171A provides the assessment procedures. NIST SP 800-53 is a federal control catalog, ISO/IEC 27001 is a separate management standard, and FIPS 199 is a categorization standard, so none of them is the Level 2 basis.

The program rule in 32 CFR Part 170 sets up the certification framework, while the DFARS acquisition rule puts the requirement into contracts. The other statements wrongly limit the reach of the rules to primes, to past awards, or to already-certified companies.

The CMMC Assessment Guide for Level 2, the NIST SP 800-171 Revision 2 requirement text, and the CMMC Model Overview are authoritative sources for Level 2 interpretation. NIST SP 800-172 applies to Level 3, and a marketing brochure is not an authoritative source.

Level 1 (Foundational) protects FCI with a basic set of practices and an annual self-assessment. Level 2 and Level 3 protect CUI, and the CMMC model has no formal Level 0.

Level 2 requires a C3PAO assessment for prioritized acquisitions, while self-assessment applies to certain non-prioritized contracts. Government-led assessment is the Level 3 route, and an IT manager's attestation without senior official sign-off is not a valid affirmation.

Level 2 certification may use a C3PAO depending on the contract type, while Level 3 is a government-led assessment. The other options reverse the assessor roles or invent assessors such as internal audit groups and Cyber AB volunteer staff.

Level 1 uses an annual self-assessment with senior official affirmation, and Level 2 practices are aligned to NIST SP 800-171. Level 3 is government-assessed rather than matching Level 1, CMMC 2.0 has three levels rather than five, and Level 1 is self-assessed rather than assessed by DIBCAC.

Access Control is one of the requirement families in NIST SP 800-171 Revision 2. Business continuity planning is covered by other NIST publications, supply chain risk management appears only in a later revision, and quantum key management is not a family in that publication.

NIST SP 800-171A defines examine, interview, and test as the assessment methods for gathering evidence. The other options describe operational or management activities performed on the system, not assessment methods.

A System Security Plan documents the system boundary and how each practice is implemented, which is why assessors review it first. The incident response plan, business continuity plan, and acceptable use policy each cover important topics but not the full scope and implementation record.

Without sufficient objective evidence, the practice is recorded as NOT MET, and it may go on a POA&M only where the Level 2 rules allow. Accepting interviews alone, assuming policy documents prove operation, or waiving the practice are not valid ways to record a finding.

A POA&M records how specific unmet practices will be remediated within a defined time frame, subject to program limits on what may be placed on it. It is not a training record, a disciplinary list, or a replacement for the System Security Plan.

Assessment evidence must be objective, current, and traceable to the practice it supports. Stale screenshots, verbal assurances alone, and unreviewed policies do not establish that a practice is implemented.

A firewall that filters traffic into a CUI enclave provides security functions for CUI assets, which makes it a Security Protection Asset. The out-of-scope option is wrong because such a device supports the protection of CUI assets, and the other categories do not describe a security device.

CUI Assets are the in-scope category for systems that handle controlled information directly. Contractor Risk Managed Assets, Specialized Assets, and Out-of-scope Assets are separate categories with different treatment in the scoping guidance.

CUI Assets, Security Protection Assets, and Contractor Risk Managed Assets are scoping categories in the CMMC guidance. Public Relations Assets and Hardware Warranty Assets are not defined categories.

A segmented enclave limits which systems process or store CUI, which reduces the scope that must meet the practices. Renaming files, moving CUI to unmanaged devices, or deleting the security plan are not valid scoping methods and would violate the requirements.

Operational technology and Internet of Things devices are typical Specialized Assets in the scoping guidance, and they are handled differently from general computing assets. A shared network segment does not make a device a CUI Asset, and the other options name categories that do not describe these devices.