The six CCP exam domains, question by question

The CCP exam has six domains, and ISACA publishes their weights in the exam content outline, Appendix A of its 2026 candidate guide. The weights are the whole of the public information about how the 170 questions are spread, and they are enough to plan around: a domain worth 35% of the exam deserves seven times the study of a domain worth 5%. This article takes the six domains in order, with the weight, the approximate number of questions, the tasks the outline sets, what a question in that domain looks like, and the documents the answers come from.

One caution on the counts. The guide says "Domain-specific percentages indicate the portion of the exam that reflects that domain content and are not used to calculate exam scores", and it also says that ISACA exams "are comprised of scored items as well as pretest items. Pretest items are not used to calculate exam scores." So 35% of 170 is about 60 questions on Domain 4, give or take, and some of the 170 you answer will not count. Your score is the total of correct answers across the exam: "Exam scores are based on the total number of exam items answered correctly, regardless of domain", and there is no passing score per domain.

Domain 1: CMMC Ecosystem (5%)

The task. "Identify and compare roles/responsibilities/requirements of authorities across the CMMC ecosystem."

What it tests. Who does what. The outline lists the authorities, from the Office of the Under Secretary of Defense and the regulation "based on trust by adding a verification component", to the accreditation body and the organizations under it (OSCs, C3PAOs, RPOs), the certification organization and its organizations and individuals, and the Assessment Team with its Lead Assessor. For each role the outline asks for its "Purpose, requirements, and benefits", and for each certified role it adds a timeline, such as the "Timeline for CCP certification and assessments."

What a question looks like. A situation with two or three roles in it and one decision that belongs to one of them: who makes the final determination on a practice when a CCP examined the evidence (the CCA providing oversight), what a C3PAO must add to a team of a Lead CCA and two CCPs (another CCA), at what point a supplier becomes an OSC (when it seeks a certification assessment). The rule's definitions decide most of them, and the rule's section on each role decides the rest.

A trap in the outline itself. The outline still uses the 2022 names: "CMMC-AB", "Licensed Partner Publishers (LPP)", "Licensed Training Providers (LTP)", "Provisional Assessors" and "Provisional Instructors", each with a "Timeline for sunsetting". The rule and ISACA's own prerequisites use the current ones: the Accreditation Body, which is The Cyber AB; Approved Publishing Partners; Approved Training Providers; the CAICO, which is ISACA. Know both sets of names, and know that the provisional roles were transitional.

The documents. 32 CFR Part 170, subpart C, one section per role; the CAP's roles and responsibilities; The Cyber AB's ecosystem pages for the RP and RPO; ISACA's pages for the CCP, CCA and CCI. The lessons: Why CMMC exists, the organizations, the individuals and the Assessment Team, all four open with a free account.

Domain 2: the Code of Professional Conduct (5%)

The task. "Identify and apply knowledge of the guiding principles and practices of the CMMC-AB Code of Professional Conduct (CoPC)/ISO/IEC/DOW requirements."

What it tests. The Code's guiding principles applied to conduct: professionalism, objectivity, confidentiality and proper use of methods are named in the outline, and the Code's version 2.0 adds impartiality, information integrity, lawful and ethical behavior, equal opportunity, and proper use of technology and artificial intelligence. The outline also points at the ISO/IEC standards the ecosystem is accredited against and at the Department's own requirements, which are the policies the rule makes the Accreditation Body adopt for conflicts of interest, professional conduct and ethics.

What a question looks like. Someone in the ecosystem does something, and the question asks which practice it breaches, or what the person should do instead: a CCP asked to come back after the assessment to fix the findings for a fee, a CCP who wants to summarize an OSC's documents in a public AI chatbot, a training provider that advertises that everyone passes. The hardest ones are conflicts of interest with a clock in them: how long after consulting for an OSC a person may join its Assessment Team.

The documents. The Code of Professional Conduct v2.0 and the conflict of interest rules in 32 CFR Part 170. The lessons: the frameworks behind the Code, objectivity, confidentiality, methods and integrity and conflicts of interest, intellectual property, lawful practice and NDAs.

Domain 3: CMMC Governance and Source Documents (15%)

The tasks. Three: "Demonstrate understanding of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in nonfederal unclassified networks"; "Determine the appropriate roles/responsibilities/authority for FCI and CUI"; and "Demonstrate understanding of the CMMC source and supplementary documents."

What it tests. The chain of authority behind the program and the two kinds of information it protects. Under the first task the outline lists the regulations and the clause, NIST SP 800-171, the FedRAMP connection, the CMMC 2.0 tenets and the rulemaking timeline, the levels with FAR 52.204-21 for Level 1 and NIST SP 800-171 for Level 2, self-assessment against third-party assessment, and the consequences of noncompliance: losing an award, contractual liability and the False Claims Act with the Justice Department's Civil Cyber-Fraud Initiative. The second task is the CUI definitions and who may designate, mark and must protect it: Executive Order 13556, 32 CFR Part 2002 and DoDI 5200.48. The third is the document set itself, from the Model Overview to the Hashing Guide, and the NARA and Department CUI registries with their markings.

What a question looks like. Definitions applied to facts: which of four systems is in a Level 1 scope given drawings "not intended for public release"; what a contractor must do with a document that carries a legacy marking; which document governs when two seem to; what must be in SPRS before award under a given set of clauses; what the score of a Level 2 self-assessment is when multifactor authentication covers remote and privileged users but not general users.

The documents. 32 CFR Part 170 and the preamble to its final rule, the DFARS clauses and the 2025 acquisition rule, FAR 52.204-21 and FAR 4.1901, NIST SP 800-171, Executive Order 13556, 32 CFR Part 2002 and the CUI Registry. The eight lessons run from the regulatory chain to the CUI registries and their markings; What to read for the CCP exam covers the documents one by one.

Domain 4: CMMC Model Construct and Implementation Evaluation (35%)

The tasks. Three again, and the first carries a condition in the outline's own words: "Given a scenario, apply the appropriate CMMC source documents as an aid to evaluate the implementation/review of CMMC practices. (At a minimum CCP candidate must be evaluated on CMMC L1 Practices during CCP exam.)" The second is "Apply knowledge of the CMMC assessment criteria and methodology to the appropriate CMMC practices", and the third "Analyze the adequacy/sufficiency around the location/collection/quality/usage of evidence."

What it tests. The model and how an assessor uses it. Under the first task the outline lists the model's architecture, the levels with their "Cumulative nature", the anatomy of a practice (its numbering scheme, its objectives, its assessment methods and objects), and the fourteen domains, with the seventeen Level 1 practices named one by one by their NIST numbers, from AC.L1-3.1.1 Authorized Access Control to SI.L1-3.14.5 System and File Scanning. The second task is the assessment criteria: practice definitions, assessment objectives, the three methods, and "Determining the assessment method(s) that would be best for gathering sufficient and accurate evidence." The third is evidence: whether what the OSA offers is adequate and sufficient.

What a question looks like. The largest domain is also the most scenario-driven. A machine shop's self-assessment finds five of a practice's six objectives met and one not, and the question asks the finding (NOT MET for the whole requirement). A traveling employee reads FCI on a hotel's business-center computer, and the question asks what that computer is under AC.L1-3.1.20 (an external system). A shop-floor computer opens with no log-on, and the question asks which objective is left unmet. A firewall allows all traffic except a block list, and the question asks which requirement's rule that breaks. Expect to be asked for the finding, the objective, the method, the object or the practice, and expect the Level 1 practices to be asked in the Level 1 guide's own terms as well as the outline's: the guide numbers Authorized Access Control AC.L1-b.1.i, after the FAR clause's first safeguard, and the outline numbers it AC.L1-3.1.1, after NIST.

The documents. The Level 1 Assessment Guide, requirement by requirement; the front matter of both Assessment Guides, for the methods, objects and findings; NIST SP 800-171 and 800-171A; the Model Overview; the rule's model section and scoring methodology. The 21 lessons begin with the model's architecture, take the seventeen Level 1 practices one lesson each, and end with assessment criteria and methods and evidence.

Domain 5: CMMC Assessment Process (25%)

The tasks. Five, one for each phase and one for the whole: the CCP's role "when developing the assessment plan (Phase 1 Plan and Prepare Assessment)"; the CCP's role "as an Assessment Team Member while conducting a CMMC assessment (Phase 2 Conduct Assessment)"; the CCP's role "in the preparation of assessment report (Phase 3 Report Assessment Results)"; the CCP's role "in the process of evaluating outstanding assessment issues on plan of action and milestones (POA&M) (Phase 4 Evaluation of Outstanding Assessment POA&M Items)"; and, "Given a scenario, determine the appropriate phases/steps to assist in the preparation/conducting/reporting on a CMMC Level 2 Assessment."

What it tests. The CAP, in sequence, from the CCP's seat. Under the tasks the outline lists the validation criteria for an OSC's evidence, the assessment plan and the readiness review; the three methods and "scoring evidence successfully for each practice"; how team members rate practices, validate preliminary results and assist with final findings; how practices on a POA&M are scored, with the "Minimum assessment score" and "Qualifying POA&M items"; and how the report is drafted, reviewed, submitted and archived.

A trap in the outline itself. The outline names the phases as the 2022 draft CAP did: Plan and Prepare, Conduct Assessment, Report Assessment Results, Evaluation of Outstanding POA&M Items. CAP version 2.0, the document in force, calls them Conduct the Pre-Assessment, Assess Conformity to Security Requirements, Complete and Report Assessment Results, and Issue Certificate and Close Out POA&M, and it puts preliminary proceedings before Phase 1. The activities line up; the names do not. Study the activities and recognize both names.

What a question looks like. A moment in an assessment and the question of what happens, who does it or in which phase it sits: which stage a conflict-of-interest check on the proposed Lead CCA belongs to, which objective an SSP that says "periodically" leaves without evidence, which method a CCP is using when an administrator plugs in a blocked USB drive on request, what route an OSC has when it disputes a NOT MET finding four days after the assessment with no new evidence, and which of several NOT MET requirements may go on a POA&M when the score is 100 of 110.

The documents. The CAP v2.0 above all, the Level 2 Assessment Guide's assessment findings, and the rule's POA&M and scoring sections. The eight lessons run from the CAP and its four phases through each phase to POA&M close-out.

Domain 6: Scoping (15%)

The tasks. Two: "Understand CMMC high-level scoping as described in the CMMC Assessment Process", and "Given a scenario, analyze the organization environment to generate an appropriate scope for FCI Assets."

What it tests. The outline's scoping is Level 1 scoping. Under the first task it lists organizational scoping: the organization, the host unit and the supporting units. Under the second, FCI assets by what they process, store or transmit; Out-of-Scope Assets; the five kinds of Specialized Asset, government property, IoT and IIoT, operational technology, restricted information systems and test equipment; and the four scoping activities, people, technology, facilities and external service providers. The Level 2 Scoping Guide, with its five asset categories, is on the exam through Domain 3's document list rather than through a Domain 6 task, and it is the CCA exam's own scoping domain.

What a question looks like. An environment described in a paragraph and a decision about one part of it: whether a firewall that stores no FCI is in scope at Level 1 (it is), how a company handles a colocation datacenter that holds its FCI server, which category fits laptops that reach CUI only through a virtual desktop that passes keyboard, video and mouse, and how a managed service provider that holds its own Level 2 certificate is treated in its customer's assessment.

The documents. The Level 1 and Level 2 Scoping Guides, the scoping section of the rule, and the CAP's scoping activities. The five lessons run from organizational scoping through FCI assets, specialized assets and the scoping activities to Level 2 scoping.

Putting the weights to work

Three domains are 75% of the exam: the model and its practices, the assessment process and scoping. Those three are also the three where the questions are scenarios rather than recall, so they reward practice, not just reading. The three small domains, 25% together, are mostly recall of roles, principles and definitions, and they are where a few hours with the rule's definitions and the Code's practices pay off quickly.

The study plan on this site starts from an eighteen-question baseline that asks every domain, ranks the domains by weight and by your results, and paces the 49 lessons to your exam date. What CCP practice questions look like shows the format with original samples; the course holds all 1,166, sorted by domain, in the app, and the first domain is free with a free account.