50 free Cyber AB CCP practice questions from the CertStash pack of 201, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 50 free here, all 201 in the pack, and each step includes the one before it.
Get all 201 questions (US$39) · Download the first 10 as a PDF
Question 1
During an assessment, which phase of the process identifies conflicts of interest?
Show answer and explanation
Correct answer: C. Verify readiness to conduct assessment.
Verifying readiness to conduct an assessment includes identifying and documenting conflicts of interest to ensure the assessment team can proceed without bias or compromised objectivity. This occurs during the readiness verification phase before the actual assessment begins.
Why the other options are wrong
- A. Analyzing requirements focuses on understanding what needs to be assessed, not on identifying conflicts of interest.
- B. Developing the assessment plan establishes the approach and scope, but conflicts of interest are verified during the readiness check.
- D. Generating final results is the concluding phase and occurs after all assessments are complete.
Question 2
Which authority leads the CMMC direction, standards, best practices, and knowledge framework for how to map the controls and processes across different Levels that range from basic cyber hygiene to advanced cyber practices?
Show answer and explanation
Correct answer: B. DoD CIO office
The DoD CIO office provides direction, standards, best practices, and the knowledge framework for CMMC, including how controls and processes map across the different maturity levels from basic cyber hygiene to advanced practices.
Why the other options are wrong
- A. NIST provides general cybersecurity frameworks and guidelines but does not lead the CMMC-specific direction and standards.
- C. The Federal CIO office handles broader federal cybersecurity policy but not CMMC-specific direction.
- D. The Defense Federal Acquisition Regulation Council handles procurement regulations but not CMMC framework leadership.
Question 3
What is objectivity as it applies to activities with the CMMC-AB?
Show answer and explanation
Correct answer: C. Avoiding the appearance of, or actual, conflicts of interest
Objectivity in CMMC-AB activities means maintaining independence and avoiding any actual or perceived conflicts of interest. This ensures that assessments and services are conducted without bias and with credibility.
Why the other options are wrong
- A. Full disclosure relates to transparency but is not the definition of objectivity in this context.
- B. Reporting results completely is about thoroughness, not about objectivity specifically.
- D. Integrity in materials relates to document handling but does not capture the essence of objectivity as independence from conflicts.
Question 4
What service is the MOST comprehensive that the RPO provides?
Show answer and explanation
Correct answer: C. Consulting services
Consulting services provided by the Registered Practitioner Organization are the most comprehensive offering, encompassing guidance on implementing controls, developing security strategies, and preparing organizations for CMMC compliance across multiple domains.
Why the other options are wrong
- A. Training services focus on education delivery but do not include the broader scope of consulting.
- B. Education services are similar to training and do not encompass the full breadth of consulting services.
- D. Assessment services evaluate compliance but do not provide the proactive guidance and strategy that consulting offers.
Question 5
The Assessment Team has completed Phase 2 of the Assessment Process. In conducting Phase 3 of the Assessment Process, the Assessment Team is reviewing evidence to address Limited Practice Deficiency Corrections. How should the team score practices in which the evidence shows the deficiencies have been corrected?
Show answer and explanation
Correct answer: A. MET
When the Assessment Team reviews evidence in Phase 3 and finds that Limited Practice deficiencies have been corrected, those practices should be scored as MET, indicating the organization has successfully addressed the previous deficiency findings.
Why the other options are wrong
- B. POA&M (Plan of Action and Milestones) is used when deficiencies remain unresolved, not when they have been corrected.
- C. NOT MET applies when deficiencies still exist and have not been addressed.
- D. NOT APPLICABLE is used when a practice does not apply to the organization's scope, not when deficiencies have been corrected.
Question 6
In preparation for a CMMC Level 1 Self-Assessment, the IT manager for a DIB organization is documenting asset types in the company’s SSP. The manager determines that identified machine controllers and assembly machines should be documented as Specialized Assets. Which type of Specialized Assets has the manager identified and documented?
Show answer and explanation
Correct answer: D. Operational technology
Machine controllers and assembly machines are examples of Operational Technology (OT), which represents specialized assets used in industrial and manufacturing environments. OT systems control physical processes and machinery, distinguishing them from traditional Information Technology. In the context of CMMC and DIB organizations, documenting these as Specialized Assets of the OT category is the correct classification for manufacturing equipment.
Why the other options are wrong
- A. IoT refers to internet-connected devices with embedded sensors, not industrial machinery like assembly machines.
- B. Restricted IS refers to information systems with specific access restrictions, not manufacturing equipment.
- C. Test equipment is used for validation and measurement purposes, not for primary production operations like assembly machines.
Question 7
According to the Configuration Management (CM) domain, which principle is the basis for defining essential system capabilities?
Show answer and explanation
Correct answer: C. Least functionality
The principle of Least Functionality forms the basis for defining essential system capabilities within the Configuration Management domain. This principle ensures that systems are configured with only the minimum necessary functions and features required to fulfill their intended purpose, reducing attack surface and unnecessary complexity.
Why the other options are wrong
- A. Least privilege applies to user access rights and permissions, not to defining system capabilities.
- B. Essential concern is not a formal principle within the CM domain framework.
- D. Separation of duties relates to organizational controls and role division, not to defining what system capabilities are essential.
Question 8
What is DFARS clause 252.204-7012 required for?
Show answer and explanation
Correct answer: A. All DoD solicitations and contracts
DFARS clause 252.204-7012 addresses the security requirements for Federal Acquisition Regulation (FAR) flows and is required for all DoD solicitations and contracts. This clause establishes baseline security expectations and applies broadly across the spectrum of DoD contracting activities.
Why the other options are wrong
- B. While FAR part 12 procedures involve commercial items, the clause applies more broadly than just those specific procedures.
- C. The clause applies beyond commercial off-the-shelf acquisitions to all DoD contracts.
- D. Commercial items sold without modifications are only a subset of what this clause covers.
Question 9
A dedicated local printer is used to print out documents with FCI in an organization. This is considered an FCI Asset. Which function BEST describes what the printer does with the FCI?
Show answer and explanation
Correct answer: C. Process
A printer used to output documents containing FCI processes that information by rendering it into physical form. Processing encompasses the handling and transformation of data, which includes printing.
Why the other options are wrong
- A. Encrypt is not the primary function of a printer; printers do not encrypt data by themselves.
- B. Manage refers to administrative control and oversight rather than the functional capability of printing.
- D. Distribute refers to transmission or sharing, not the output activity of a printer.
Question 10
What is the LAST step when developing an assessment plan for an OSC?
Show answer and explanation
Correct answer: D. Obtain and record commitment to the assessment plan.
The final step in developing an assessment plan for an OSC is obtaining and recording commitment from relevant stakeholders to the assessment plan. This formalizes agreement and ensures all parties are ready to proceed.
Why the other options are wrong
- A. Verifying readiness to conduct the assessment occurs before finalizing the plan, not after.
- B. Performing a certification assessment readiness review happens during plan development, not as the last step.
- C. Updating the assessment plan occurs throughout the process but is not the final step to close out plan development.
What people say about the full CCP pack 5.0 from 1
I took the CMMC-CCP exam, and it was a bit tricky. The exam questions and study material were key in my preparation. I’m glad I used these resources to help me succeed.
Question 11
Who is responsible for ensuring that subcontractors have a valid CMMC Certification?
Show answer and explanation
Correct answer: D. Contractor organization
The contractor organization is responsible for ensuring that subcontractors have valid CMMC Certifications. This responsibility flows from the prime contractor's requirement to maintain compliance with contractual obligations and DoD requirements. The contractor cannot outsource this compliance responsibility to external authorities.
Why the other options are wrong
- A. The CMMC-AB certifies organizations but does not monitor or enforce subcontractor certification responsibilities for contractors.
- B. OUSD A&S establishes requirements but does not directly enforce subcontractor compliance at the contractor level.
- C. While the DoD or client may require CMMC certification, the contractor bears the direct responsibility for verifying subcontractor compliance.
Question 12
When assessing an OSC for CMMC, the Lead Assessor should use the information from the Discussion and Further Discussion sections in each practice because it:
Show answer and explanation
Correct answer: D. provides additional information to facilitate the assessment of the practice.
The Discussion and Further Discussion sections in CMMC practices provide interpretive guidance, context, and examples that help assessors and organizations understand the intent and implementation of each practice. This information is informative and facilitates accurate assessment by clarifying expectations and providing real-world scenarios, but it is not prescriptive or mandatory in the way normative requirements are.
Why the other options are wrong
- A. While helpful, the Discussion sections are guidance, not normative requirements that OSCs must strictly follow.
- B. Examples are illustrative but not mandatory implementations; organizations may implement practices differently.
- C. The Discussion sections are not mandatory compliance requirements and are not tied to FAR Clause 52.204-21 as binding obligations.
Question 13
Within how many days from the Assessment Final Recommended Findings Brief should the Lead Assessor and Assessment Team Members, if necessary, review the accuracy and validity of the OSC’s updated POA&M with any accompanying evidence or scheduled collections?
Show answer and explanation
Correct answer: A. 90 days
The Lead Assessor and Assessment Team Members must review the accuracy and validity of the OSC's updated Plan of Action and Milestones (POA&M) within 90 days from the Assessment Final Recommended Findings Brief. This 90-day window ensures timely verification of corrective actions and evidence collection before the certification becomes stale.
Why the other options are wrong
- B. 180 days exceeds the required review timeframe established in CMMC procedures.
- C. 270 days is too long and does not align with CMMC assessment timelines.
- D. 360 days is excessive and would delay verification of OSC's corrective actions.
Question 14
Which domain has a practice requiring an organization to restrict, disable, or prevent the use of nonessential programs?
Show answer and explanation
Correct answer: D. Configuration Management (CM)
Configuration Management (CM) includes practices requiring organizations to restrict, disable, or prevent the use of nonessential programs and services to reduce the attack surface and maintain a secure configuration baseline.
Why the other options are wrong
- A. Access Control (AC) focuses on user authentication and authorization, not program restrictions.
- B. Media Protection (MP) addresses protection of physical and digital media, not program usage restrictions.
- C. Asset Management (AM) deals with inventory and lifecycle management of assets, not program usage controls.
Question 15
A machining company has been awarded a contract with the DoD to build specialized parts. Testing of the parts will be done by the company using in-house staff and equipment. For a Level 1 Self-Assessment, what type of asset is this?
Show answer and explanation
Correct answer: B. In-scope Asset
For a Level 1 Self-Assessment, testing equipment and facilities used by the company to build DoD contract parts are classified as in-scope assets. These assets are part of the organizational system that must be evaluated for CMMC compliance since they are directly involved in the contract work.
Why the other options are wrong
- A. CUI (Controlled Unclassified Information) assets are data classifications, not asset types; the equipment itself is not classified as a CUI asset.
- C. Specialized Asset is not a recognized CMMC asset classification category.
- D. Contractor Risk Managed Asset is not a standard CMMC asset classification term.
Question 16
A CCP is working as an Assessment Team Member on a CMMC Level 2 Assessment. The Lead Assessor has assigned the CCP to assess the OSC’s Configuration Management (CM) domain. The CCP’s first interview is with a subject-matter expert for user-installed software. With respect to user-installed software, what facet should the CCP’s interview focus on?
Show answer and explanation
Correct answer: A. Controlled and monitored
CMMC Level 2 Configuration Management domain practices require that software configurations be controlled and monitored to prevent unauthorized changes and ensure system integrity. When assessing user-installed software, the CCP must determine whether such installations are tracked, managed, inventoried, and monitored within the organization's configuration management process. This focus on control and monitoring ensures compliance with CM practices that demand visibility and governance over system components.
Why the other options are wrong
- B. Removal is not the assessment focus; controlled and monitored software management is the practice requirement.
- C. Malware scanning is an access control or protection practice, not a configuration management primary concern.
- D. Limiting software to mission-essential use is a selection/access control criterion, not the configuration management control mechanism.
Question 17
Which principles are included in defining the CMMC-AB Code of Professional Conduct?
Show answer and explanation
Correct answer: B. Objectivity, confidentiality, and information integrity
The CMMC-AB Code of Professional Conduct is built on three core principles: Objectivity (making unbiased, fair assessments), Confidentiality (protecting sensitive information gathered during assessments), and Information Integrity (ensuring the accuracy and reliability of assessment data and findings). These principles guide the professional conduct of all CMMC professionals.
Why the other options are wrong
- A. Classification is not a principle in the Code of Professional Conduct; the correct third principle is Confidentiality, not classification.
- C. Responsibility is not one of the three named principles; the actual principles are Objectivity, Confidentiality, and Information Integrity.
- D. While Integrity is correct, Responsibility is not one of the three core principles defined in the CMMC-AB Code of Professional Conduct.
Question 18
Ethics is a shared responsibility between:
Show answer and explanation
Correct answer: C. CMMC-AB and members of the CMMC Ecosystem.
Ethics is a shared responsibility between the CMMC-AB and all members of the CMMC Ecosystem. The CMMC-AB establishes ethical standards and policies, while ecosystem members, including C3PAOs, Lead Assessors, OSCs, and all other participants, are responsible for upholding and adhering to those standards in their roles and activities.
Why the other options are wrong
- A. While DoD and CMMC-AB interact, ethics responsibility extends beyond just these two entities.
- B. Ethics responsibility is not limited to OSCs and sponsors; it encompasses the entire ecosystem.
- D. This omits the CMMC-AB's role in establishing and overseeing ethical standards.
Question 19
How does the CMMC define a practice?
Show answer and explanation
Correct answer: D. An activity or activities performed to meet defined CMMC objectives
The CMMC framework defines a practice as an activity or activities performed to meet defined CMMC objectives. Practices are the specific actions and processes that organizations implement to achieve compliance with the security objectives at each maturity level. This definition aligns with the CMMC model's focus on behavioral outcomes and measurable implementation.
Why the other options are wrong
- A. A business transaction does not capture the security-focused nature of CMMC practices.
- B. While experience-based, this definition is too vague and does not reflect CMMC's objective-oriented approach.
- C. A series of changes in a defined manner describes a process, not specifically a CMMC practice.
Question 20
A CCP is on their first assessment for CMMC Level 2 with an Assessment Team and is reviewing the CMMC Assessment Process to understand their responsibilities. Which method gathers information from the subject matter experts to facilitate understanding and achieve clarification?
Show answer and explanation
Correct answer: C. Interview
Interview is the assessment method that gathers information from subject matter experts to facilitate understanding and achieve clarification. Interviews allow assessors to ask questions, probe deeper into responses, and obtain context-specific information that documents alone cannot provide. Test refers to evaluating system functionality, Examine refers to reviewing artifacts and documentation, and Assessment is the broader process itself.
Why the other options are wrong
- A. Test evaluates system functionality and performance rather than gathering expert knowledge.
- B. Examine involves reviewing existing documentation and artifacts, not interactive information gathering.
- D. Assessment is the overall process, not a specific method for gathering information from experts.
Question 21
At which CMMC Level do the Security Assessment (CA) practices begin?
Show answer and explanation
Correct answer: B. Level 2
Security Assessment (CA) practices begin at CMMC Level 2. Level 1 contains only basic practices without assessment requirements, while Level 2 introduces the need for formal assessment and monitoring of security controls.
Why the other options are wrong
- A. Level 1 does not include Security Assessment practices; it focuses on basic controls without formal assessment.
- C. Security Assessment practices are not introduced at Level 3; they begin earlier at Level 2.
- D. Level 4 is beyond where Security Assessment practices are first introduced.
Question 22
In late September, CA.L2-3.12.1: Periodically assess the security controls in organizational systems to determine if the controls are effective in their application is assessed. Procedure specifies that a security control assessment shall be conducted quarterly. The Lead Assessor is only provided the first quarter assessment report because the person conducting the second quarter’s assessment is currently out of the office and will return to the office in two hours. Based on this information, the Lead Assessor should determine that the evidence is:
Show answer and explanation
Correct answer: B. insufficient, and rate the audit finding as NOT MET.
The control requires quarterly assessments, and as of late September, at least two assessments should have been completed (Q1 and Q2). The organization has only provided one assessment report; regardless of the reason for the missing Q2 report or when the assessor returns to the office, the current evidence is insufficient to demonstrate compliance with the quarterly requirement. A Lead Assessor cannot rate the finding as MET when required periodic evidence is missing.
Why the other options are wrong
- A. Only one quarter's assessment does not satisfy a quarterly assessment requirement; the evidence is demonstrably insufficient.
- C. While additional evidence may eventually prove compliance, the current evidence is insufficient and the finding cannot be rated MET at this time.
- D. Although the assessor should seek the missing Q2 report, the current evidence is insufficient and the finding should be rated NOT MET based on the gap in required periodic assessments.
Question 23
While conducting a CMMC Assessment, a Lead Assessor is given documentation attesting to Level 1 identification and authentication practices by the OSC. The Lead Assessor asks the CCP to review the documentation to determine if identification and authentication controls are met. Which documentation BEST satisfies the requirements of IA.L1-3.5.1: Identify system users, processes acting on behalf of users, and devices?
Show answer and explanation
Correct answer: C. User names associated with system accounts assigned to those individuals
User names associated with system accounts assigned to those individuals directly satisfies IA.L1-3.5.1 by providing evidence that system users are identified. This practice requires that the organization maintain a record linking user identities to their assigned system accounts. The other options address related but different requirements: access control lists implement authorization rather than identification, unauthorized user lists do not identify legitimate users, and physical access policies address physical security rather than system user identification.
Why the other options are wrong
- A. Access control lists document authorization decisions, not the identification of users themselves.
- B. A list of unauthorized users does not satisfy the requirement to identify authorized system users.
- D. Physical access policy addresses facility security, not system user identification requirements.
Question 24
When are contractors required to achieve a CMMC certificate at the Level specified in the solicitation?
Show answer and explanation
Correct answer: A. At the time of award
Contractors are required to achieve and maintain a CMMC certificate at the level specified in the solicitation at the time of contract award. This ensures that only organizations meeting the required security maturity level are selected for contracts involving controlled unclassified information or Federal contract information at the specified sensitivity level.
Why the other options are wrong
- B. Certification is not required at solicitation submission; it is required at the time of award.
- C. There is no standard 30-day grace period from the award date for achieving certification.
- D. The requirement is at award, not merely before submission due dates.
Question 25
Which regulation allows for whistleblowers to sue on behalf of the federal government?
Show answer and explanation
Correct answer: C. False Claims Act
The False Claims Act is the federal regulation that allows whistleblowers to sue on behalf of the federal government under qui tam provisions. This law protects contractors and subcontractors who report fraud or violations of contract terms. NIST standards are technical guidelines, not legal frameworks for whistleblower protections.
Why the other options are wrong
- A. NIST SP 800-53 is a security controls framework, not whistleblower legislation.
- B. NIST SP 800-171 is a security requirements standard, not whistleblower legislation.
- D. Code of Professional Conduct establishes ethical standards but does not create a legal mechanism for whistleblower lawsuits.
Question 26
What is a PRIMARY activity that is performed while conducting an assessment?
Show answer and explanation
Correct answer: B. Collect and examine evidence.
Collecting and examining evidence is a primary activity performed during the actual assessment. This is when the assessment team gathers affirmations through interviews, demonstrations, and documentation review to determine if practices are met. Developing the assessment plan occurs before the assessment begins, verifying readiness is a pre-assessment activity, and delivering results occurs after the assessment concludes.
Why the other options are wrong
- A. Developing the assessment plan is a pre-assessment activity, not a primary activity during assessment.
- C. Verifying readiness to conduct assessment occurs before the assessment starts.
- D. Delivering recommended results is a post-assessment activity after evidence analysis is complete.
Question 27
Which term describes “the protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information”?
Show answer and explanation
Correct answer: C. Adequate security
Adequate security is defined as the protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information. This term reflects the principle that security controls should be proportionate to the risk and impact potential.
Why the other options are wrong
- A. Adopted security refers to security measures that have been chosen or accepted, not necessarily proportionate security.
- B. Adaptive security refers to dynamic or responsive security that adjusts to changing threats, not proportionality to consequences.
- D. Advanced security refers to sophisticated or state-of-the-art security measures, not necessarily commensurate with specific risk levels.
Question 28
During a Level 2 Assessment, an OSC provides documentation that attests that they utilize multifactor authentication on nonlocal remote maintenance sessions. The OSC feels that they have met the controls for the Level 2 certification. What additional measures should the OSC perform to fully meet the maintenance requirement?
Show answer and explanation
Correct answer: A. Connections for nonlocal maintenance sessions should be terminated when maintenance is complete.
Beyond implementing multifactor authentication, Level 2 controls require that nonlocal maintenance sessions be terminated when maintenance work is complete. This additional measure prevents unauthorized continued access and ensures that maintenance connections are not left open longer than necessary, reducing security risk.
Why the other options are wrong
- B. Unlimited connections contradict security best practices and the principle of least privilege.
- C. Security requirements cannot be removed based on personnel preferences; controls exist to protect sensitive systems.
- D. While multifactor authentication requirements are important, this describes what should already be in place, not an additional measure.
Question 29
When assessing SI.L2-3.14.6: Monitor communications for attack, the CCA interviews the person responsible for the intrusion detection system and examines relevant policies and procedures for monitoring organizational systems. What would be a possible next step the CCA could conduct to gather sufficient evidence?
Show answer and explanation
Correct answer: D. Review an artifact to check key references for the configuration of the IDS or IPS practice for additional guidance on intrusion detection and prevention systems.
Reviewing artifacts and configuration documentation for the IDS or IPS system is the appropriate next step. This allows the CCA to examine system settings, logs, and technical evidence of monitoring capability without creating risk or disrupting operations, while still gathering the necessary evidence to validate that the monitoring practice is properly implemented.
Why the other options are wrong
- A. Penetration testing is a separate security validation activity and is not a standard assessment procedure for this control.
- B. Interviewing the supplier does not provide direct evidence of the organization's current monitoring implementation.
- C. Uploading malicious code is operationally dangerous, creates liability, and is not an appropriate assessment technique.
Question 30
Which statement BEST describes the key references a Lead Assessor should refer to and use the:
Show answer and explanation
Correct answer: D. published CMMC Assessment Guide practice descriptions for the desired certification level.
The CMMC Assessment Guide contains the official practice descriptions, assessment methods, and detailed requirements for each maturity level. Lead Assessors rely on this guide to understand what evidence is needed, how to evaluate controls, and what constitutes sufficient proof of implementation for the specific certification level being pursued.
Why the other options are wrong
- A. The DoD adequate security checklist applies to covered defense information but is not the primary reference document for assessment methodology and practice descriptions.
- B. The CMMC Model Overview provides high-level overview information but the Assessment Guide contains the specific assessment methods and objects needed for evaluations.
- C. FAR 52.204-21 establishes safeguarding requirements but is not the assessment reference; it applies to all CMMC levels, not just Level 2.
Question 31
An Assessment Team is conducting a Level 2 Assessment at the request of an OSC. The team has begun to score practices based on the evidence provided. At a MINIMUM, what is required of the Assessment Team to determine if a practice is scored as MET?
Show answer and explanation
Correct answer: D. Complete two of the following: examine one artifact, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.
At minimum, an Assessment Team must complete two of the following evidence types to determine if a practice is scored as MET: examine one artifact, observe a satisfactory demonstration of one control, or receive one affirmation from OSC personnel. This two-of-three requirement ensures triangulation of evidence from multiple sources.
Why the other options are wrong
- A. All three evidence types for every control is an ideal but not a minimum requirement; assessments must be efficient.
- B. One evidence type alone is insufficient; multiple evidence sources strengthen assessment confidence.
- C. One complete action is insufficient; the requirement explicitly states two of the three evidence methods must be satisfied.
Question 32
An OSC needs to be assessed on RA.L2-3.11.1: Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI. What is in scope for a Level 2 assessment of RA.L2-3.11.1?
Show answer and explanation
Correct answer: D. Processes, people, physical entities, and IT systems in which CUI processed, stored, or transmitted
NIST SP 800-171B RA.L2-3.11.1 requires periodic risk assessments that consider all entities involved in CUI processing, storage, and transmission. A Level 2 assessment must have comprehensive scope encompassing the complete ecosystem: people (users, administrators, contractors), processes (workflows, procedures, change management), physical entities (facilities, equipment, storage), and IT systems (networks, applications, databases). Options A, B, and C represent only partial views of the required scope.
Why the other options are wrong
- A. IT systems alone omit the people, processes, and physical infrastructure components that also affect CUI security risk.
- B. Enterprise systems is too broad and undefined; the requirement is specifically about systems and entities processing, storing, or transmitting CUI.
- C. CUI marking processes are only one small process component and do not represent the full scope of processes, people, physical entities, and systems required.
Question 33
Which phase of the CMMC Assessment Process includes developing the assessment plan?
Show answer and explanation
Correct answer: A. Phase 1
Phase 1 of the CMMC Assessment Process includes developing the Assessment Plan. During this planning phase, the C3PAO and OSC collaborate to define the scope, objectives, methodology, resources, schedule, and other essential elements before conducting the actual assessment activities in subsequent phases.
Why the other options are wrong
- B. Phase 2 involves conducting the on-site assessment activities, not planning.
- C. Phase 3 involves reporting findings and developing POA&Ms, not initial planning.
- D. Phase 4 is the final recommendation and decision phase, occurring after assessment completion.
Question 34
The CMMC Level 2 assessment methods include examination and can include:
Show answer and explanation
Correct answer: A. documents, mechanisms, or activities.
The CMMC Level 2 assessment methods include examination and can include documents, mechanisms, or activities. These are broad categories that encompass all types of evidence an assessor might review, such as written policies, security controls, system configurations, and organizational activities. This formulation provides flexibility for assessors to examine various evidence types depending on the specific practice being assessed.
Why the other options are wrong
- B. While specific hardware and software may be examined, the framework uses the broader term 'mechanisms' to encompass all technological safeguards.
- C. These are examples of what might be examined, but the formal framework refers to 'documents, mechanisms, or activities' as the assessment method categories.
- D. These are specific examples of activities that might be examined, but not the formal categorization of assessment methods.
Question 35
Which statement BEST describes an LTP?
Show answer and explanation
Correct answer: B. Instructs a curriculum approved by CMMC-AB
An LTP (Licensed Training Provider) is an organization that instructs a curriculum approved by the CMMC-AB. This is the defining characteristic of an LTP, they deliver training content that aligns with CMMC-AB-approved learning objectives and standards.
Why the other options are wrong
- A. LTPs do not create DoD-licensed training; they deliver training within CMMC-AB approval frameworks.
- C. LTPs market themselves as licensed training providers, not as assessment testing providers; C3PAOs conduct assessments.
- D. Using 'some' objectives is imprecise; LTPs must deliver a curriculum fully approved by CMMC-AB, not partial knowledge.
Question 36
Which term describes the process of granting or denying specific requests to obtain and use information, related information processing services, and enter specific physical facilities?
Show answer and explanation
Correct answer: A. Access control
Access control is the overarching security discipline that encompasses the process of granting or denying specific requests to obtain and use information, access information processing services, and enter physical facilities. This definition applies to both logical and physical access decisions. Physical access control (option B) is a subset focusing only on facilities. Mandatory and Discretionary access control (options C and D) are specific implementation models or methodologies within access control, not descriptions of the granting/denying decision process itself.
Why the other options are wrong
- B. Physical access control is limited to facility access and does not encompass information access and processing services.
- C. Mandatory access control is a specific access control model, not the general process of granting or denying access requests.
- D. Discretionary access control is another specific model, not the general definition of the granting/denying decision process.
Question 37
A CCP is part of a CMMC Assessment Team interviewing a subject-matter expert on Access Control (AC) within an OSC. During the interview process, what will the CCP ensure about the information exchanged during the interview?
Show answer and explanation
Correct answer: C. Confidential and non-attributable so interviewees can speak without fear of reprisal
During CMMC Assessment Team interviews with subject-matter experts, the CCP ensures that information exchanged is confidential and non-attributable. This protection is critical to allow interviewees to speak freely and honestly without fear of reprisal or negative consequences, which supports the integrity of the assessment process.
Why the other options are wrong
- A. Interviews should be conducted individually or in small controlled groups to maintain confidentiality, not in larger groups for efficiency.
- B. Interviews are not recorded for the Final Recommended Findings report; confidentiality protections prevent such recording.
- D. While practices are evaluated, interviews are not structured around explicit practice mapping; they focus on broader control discussion areas.
Question 38
Which example represents a Specialized Asset?
Show answer and explanation
Correct answer: A. SOCs
Specialized Assets are external service providers or facilities with specialized functions that require unique consideration in CMMC scope. Security Operations Centers (SOCs) represent specialized external capabilities that provide enhanced monitoring and threat response services. They are categorized as Specialized Assets because they perform dedicated cybersecurity functions beyond standard IT infrastructure.
Why the other options are wrong
- B. Hosted VPN services are typically classified as an ESP (External Service Provider), not a Specialized Asset.
- C. Consultants providing cybersecurity services are people/personnel resources, not Specialized Assets in the CMMC asset taxonomy.
- D. Government-owned or leased property is not representative of Specialized Assets in the CMMC context.
Question 39
During the planning phase of a CMMC Level 2 Assessment, the Lead Assessor is considering what would constitute the right evidence for each practice. What is the Assessor attempting to verify?
Show answer and explanation
Correct answer: B. Sufficiency
During assessment planning, the Lead Assessor must determine what constitutes sufficient evidence, that is, adequate quantity and quality of evidence, to support findings for each practice. Sufficiency addresses whether the collected evidence is enough to draw reliable conclusions about practice implementation. Adequacy relates to suitability of evidence type, process mapping is a planning technique, and assessment scope defines what will be assessed, but sufficiency directly addresses the evidence threshold question.
Why the other options are wrong
- A. Adequacy refers to the suitability of evidence type, not the quantity question of what constitutes 'enough' evidence.
- C. Process mapping is a technique within evidence planning but does not describe the evidence threshold being verified.
- D. Assessment scope defines boundaries of what to assess, not the standard for evidence quantity and quality.
Question 40
What are CUI protection responsibilities?
Show answer and explanation
Correct answer: D. Safeguarding
Safeguarding is the primary responsibility for CUI protection. Organizations handling Controlled Unclassified Information must implement appropriate safeguards to protect it from unauthorized access, use, or disclosure, including physical, technical, and administrative controls.
Why the other options are wrong
- A. Shielding is not the standard CUI protection terminology; safeguarding is the correct term.
- B. Governing refers to policy and rule-making, which supports but is not the core protection responsibility.
- C. Correcting refers to remediation actions after incidents, not the primary ongoing protection responsibility.
Question 41
Which term describes the prevention of damage to, protection of, and restoration of computers and electronic communications systems/services, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation?
Show answer and explanation
Correct answer: A. Cybersecurity
Cybersecurity is the overarching term that encompasses the prevention of damage to, protection of, and restoration of computers and electronic communications systems and services, including their information, to ensure availability, integrity, authentication, confidentiality, and nonrepudiation. While data security and network security are components of cybersecurity, and information security is closely related, cybersecurity is the broadest and most appropriate term that captures the complete definition provided in the question.
Why the other options are wrong
- B. Data security focuses specifically on protecting data itself rather than the comprehensive systems, services, and communications infrastructure described.
- C. Network security addresses only the network infrastructure component, not the full scope of computers, communications systems, and restoration capabilities.
- D. Information security is similar but typically focuses on information assets rather than the broader restoration and protection of entire systems and services.
Question 42
When assessing SI.L1-3.14.2: Provide protection from malicious code at appropriate locations within organizational information systems, evidence shows that all of the OSC’s workstations and servers have antivirus software installed for malicious code protection. A centralized console for the antivirus software management is in place and records show that all devices have received the most updated antivirus patterns. What is the BEST determination that the Lead Assessor should reach regarding the evidence?
Show answer and explanation
Correct answer: A. It is sufficient, and the audit finding can be rated as MET.
The requirement asks that malicious code protection be provided at appropriate locations, and the evidence shows antivirus on every workstation and server, managed from a central console, with all devices on the latest patterns. That demonstrates both that protection is in place and that it is kept current, so the evidence is sufficient and the practice can be rated MET.
Why the other options are wrong
- B. The evidence directly shows the protection mechanism deployed and maintained, so rating it NOT MET is not supported.
- C. When evidence is already sufficient there is no need to keep collecting more before making a determination.
- D. Full endpoint coverage with centrally verified, current signatures is adequate evidence for this Level 1 practice, so it is not insufficient.
Question 43
Which organization is the governmental authority responsible for identifying and marking CUI?
Show answer and explanation
Correct answer: A. NARA
NARA (National Archives and Records Administration) is the governmental authority responsible for identifying and marking Controlled Unclassified Information (CUI). NARA maintains the CUI Registry and establishes the CUI program policies and procedures. While NIST provides guidance on security controls and DHS may work with CUI, NARA holds the primary responsibility for CUI identification and marking.
Why the other options are wrong
- B. NIST provides cybersecurity standards and guidance but is not the authority for identifying and marking CUI.
- C. CMMC-AB manages the CMMC program but does not serve as the governmental authority for CUI identification and marking.
- D. While DHS plays a security role, NARA is the designated authority for CUI identification and marking.
Question 44
When are data and documents with legacy markings from or for the DoD required to be re-marked or redacted?
Show answer and explanation
Correct answer: D. When a derivative document’s original information is not CUI
Legacy markings from or for the DoD must be re-marked or redacted when a derivative document's original information is not CUI. This addresses the transition from older classification systems to the Controlled Unclassified Information (CUI) framework. When information is derived from legacy sources but does not meet CUI criteria, re-marking or redaction becomes necessary to ensure proper handling under current standards.
Why the other options are wrong
- A. Being under DoD control alone does not automatically trigger re-marking; the content classification status matters more.
- B. Secret designation is a classification level, not a trigger for re-marking legacy documents under CUI rules.
- C. Sharing outside the organization may require additional controls, but is not the specific requirement for re-marking legacy documents.
Question 45
A client uses an external cloud-based service to store, process, or transmit data that is reasonably believed to qualify as CUI. According to DFARS clause 252.204-7012, what set of established security requirements MUST that cloud provider meet?
Show answer and explanation
Correct answer: B. FedRAMP Moderate
DFARS clause 252.204-7012 mandates that external cloud service providers storing, processing, or transmitting CUI must meet FedRAMP Moderate baseline security requirements. This represents the minimum acceptable assurance level for CUI in cloud environments under federal acquisition regulations. FedRAMP Low is insufficient for CUI protection, while High and Secure are either excessive for standard CUI or non-standard designations.
Why the other options are wrong
- A. FedRAMP Low does not provide sufficient security controls for CUI data protection.
- C. FedRAMP High exceeds the DFARS requirement; Moderate is the mandated baseline.
- D. FedRAMP Secure is not a recognized FedRAMP authorization level.
Question 46
A contractor provides services and data to the DoD. The transactions that occur to handle FCI take place over the contractor’s business network, but the work is performed on contractor-owned systems, which must be configured based on government requirements and are used to support a contract. What type of Specialized Asset are these systems?
Show answer and explanation
Correct answer: B. Restricted IS
Systems that are contractor-owned but configured according to government requirements and used to support DoD contracts handling Federal Contract Information (FCI) are classified as Restricted IS (Information Systems). These systems have restricted use due to government requirements and the sensitive nature of the work performed, even though they are owned by the contractor.
Why the other options are wrong
- A. IoT refers to internet-connected devices with sensors, not contractor systems configured for government contract work.
- C. Test equipment is used for validation and testing purposes, not for operational handling of FCI and contract performance.
- D. Government property would be systems owned by the government, not contractor-owned systems.
Question 47
As part of CMMC 2.0, the change to Level 1 Self-Assessments supports “reduced assessment costs” allows all companies at Level 1 (Foundational) to:
Show answer and explanation
Correct answer: A. conduct self-assessments.
CMMC 2.0 introduced self-assessments for Level 1 (Foundational) organizations as a cost-reduction measure. This allows companies to conduct their own assessments without requiring a third-party C3PAO assessor, significantly reducing assessment costs while maintaining compliance verification.
Why the other options are wrong
- B. Level 1 organizations still need to demonstrate compliance and cannot opt out of CMMC requirements entirely.
- C. The DoD does not reimburse assessment costs; self-assessment reduces costs by eliminating third-party assessor fees.
- D. There is no fixed $500 annual assessment cost limit established in CMMC 2.0.
Question 48
While developing an assessment plan for an OSC, it is discovered that the certified assessor will be interviewing a former college roommate. What is the MOST correct action to take?
Show answer and explanation
Correct answer: D. Inform the OSC and the C3PAO of the possible conflict of interest, document the conflict and mitigation actions in the assessment plan, and if the mitigation actions are acceptable, continue with the assessment.
When a potential conflict of interest is identified between an assessor and an interviewee, the proper procedure is to inform both the OSC and the C3PAO, document the conflict, propose mitigation actions within the assessment plan, and proceed only if all parties accept the mitigation strategy. This approach maintains transparency while allowing the assessment to continue if appropriate safeguards are established.
Why the other options are wrong
- A. Concealing a potential conflict of interest violates assessment integrity standards and professional ethics.
- B. Restarting the entire process is an unnecessarily extreme response when documented mitigation can address the concern.
- C. Time elapsed does not automatically eliminate conflict of interest; the potential for bias must still be addressed through formal mitigation.
Question 49
Which document BEST determines the existence of FCI and/or CUI in scoping an assessment with an OSC?
Show answer and explanation
Correct answer: D. OSC Contract with DoD
The OSC Contract with DoD best determines the existence of FCI and/or CUI during assessment scoping. The contract explicitly specifies what information the organization will handle for the government, which identifies whether FCI or CUI requirements apply. While the SSP, POA&M, and Evidence provide supporting information, the contract is the authoritative source document that defines the scope and nature of information to be handled.
Why the other options are wrong
- A. The OSC SSP documents security controls but may not clearly articulate the contract requirements.
- B. The POA&M addresses remediation plans, not the determination of what information is in scope.
- C. Evidence documents implementation but does not determine whether CUI/FCI exist in the first place.
Question 50
How are the Final Recommended Assessment Findings BEST presented?
Show answer and explanation
Correct answer: A. Using the CMMC Findings Brief template
The CMMC Findings Brief template is the standard, approved template mandated by the CMMC Assessment Guide for presenting Final Recommended Assessment Findings. Using this standardized template ensures consistency across all CMMC assessments and compliance with CMMC-AB requirements.
Why the other options are wrong
- B. C3PAO-provided templates that deviate from the standard are not acceptable for official submission.
- C. While C3PAO branding may be applied, the foundation must be the official CMMC Findings Brief template, not a modified version.
- D. Proprietary Lead Assessor templates are not authorized; the standardized CMMC template must be used.
That was 50 of 201.
The full Cyber AB CCP pack has all 201 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 85 free as one PDF by email. Get the Half Pack →