CMMC CCP flashcards: 60 free cards, by domain

Here are sixty flashcards for the CMMC Certified Professional (CCP) exam, ten from each of its six domains, taken from the 1,163 cards on this site. Each card has a front, a back, and the document the back comes from, because a flashcard is only as good as its source, and the sets that circulate for this exam are mostly unsourced and several still carry 2022 names. These are written from the rule, the CAP, the guides, the Code and the NIST publications as they stand.

Flashcards do one job the practice questions do not: they make you produce the fact rather than recognize it. The exam's questions are multiple choice, but the stem of a well-written question is answerable before the options are read, and that is what recall practice builds. Use these the old way: cover the back, say the answer out loud or write it, then turn the card. A card you got wrong goes back into the pile; a card you got right goes to the end.

How to use the sixty

Say it before you look. A card you half-knew is a card you did not know. Count only the answers you produced in full.
Work by domain, then mix. The first pass by domain shows you where you are weak; later passes should shuffle all sixty, because the exam mixes its domains.
Mind the counts. Domain 4 is 35% of the exam and Domain 5 is 25%, so a weak result in those two domains costs more than a weak result in Domains 1 and 2, which are 5% each.
Note the source. When a back names the rule, the exam's answer is the rule's text. When it names a guide, the guide's wording is what the question will echo.

Domain 1: CMMC Ecosystem (5% of the exam)

Front	Back	Source
From which three sources does the CMMC Model take its security requirements?	FAR 52.204-21, NIST SP 800-171 Rev 2, and selected requirements of NIST SP 800-172.	32 CFR Part 170
How many Level 1 security requirements does 32 CFR Part 170 count?	15, the safeguards of FAR 52.204-21.	32 CFR Part 170
How many Level 1 practices does the CCP exam outline count?	17, the same safeguards numbered after NIST SP 800-171.	ISACA candidate guide
How many Level 2 security requirements are there?	110, those of NIST SP 800-171 Rev 2.	32 CFR Part 170
Why is there no Conditional Level 1 status?	A Conditional status rests on a POA&M, and no POA&M is permitted at Level 1.	32 CFR Part 170
When must an Affirming Official affirm continuing compliance in SPRS?	After every assessment, including POA&M closeout, and annually thereafter.	32 CFR Part 170
Why is every OSC also an OSA?	An OSA seeks a self-assessment or a certification assessment for any CMMC Status; an OSC seeks a certification assessment.	32 CFR Part 170
Which two responsibilities define the role of a C3PAO?	Conducting Level 2 certification assessments and issuing Certificates of CMMC Status to OSCs on the results.	32 CFR Part 170
What activity separates a CCP from a Registered Practitioner, though both advise clients?	Participating in Level 2 certification assessments, with CCA oversight.	ISACA candidate guide
For how long is a CCP, CCA or CCI certification valid?	3 years from the date of issuance.	32 CFR Part 170

Domain 2: the Code of Professional Conduct (5%)

Front	Back	Source
How many guiding principles form the foundation of the CMMC Code of Professional Conduct?	Eight.	Code of Professional Conduct v2.0
Which obligations does the CoPC place on OSAs and OSCs?	None: they are not bound by it, though they are encouraged to adopt its practices where applicable.	Code of Professional Conduct v2.0
To what kind of AI application must a CMMC Ecosystem member never provide customer data?	An Internet-accessible AI application.	Code of Professional Conduct v2.0
Which three kinds of guarantee must a CMMC Ecosystem member forgo making?	Assessment success from engaging a credentialed individual or authorized organization, money-back guarantees, and exam passes from a specific training program.	Code of Professional Conduct v2.0
The CoPC has no Objectivity principle; which of its guiding principles calls for unbiased decision-making?	Impartiality, which also covers avoiding conflicts of interest.	Code of Professional Conduct v2.0
Which commercial conversations must ecosystem members avoid with clients during an active certification assessment?	Soliciting business, and any discussion of future consulting engagements.	Code of Professional Conduct v2.0
How long must information gathered in a CMMC assessment or consulting engagement stay confidential?	Beyond the engagement: it remains confidential even after the work has ended.	Code of Professional Conduct v2.0
Under which of the three NIST SP 800-171A assessment methods does observing fall?	Examine: reviewing, inspecting, observing, studying or analyzing assessment objects.	Level 2 Assessment Guide
Between which two parties does the primary CMMC conflict of interest lie?	The C3PAO, most importantly the individuals on its Assessment Team, and the OSC to be assessed.	Code of Professional Conduct v2.0
At which four points in a Level 2 certification assessment must conflicts of interest be checked?	Before the assessment starts, before Phase 2, at the In-Brief Meeting, and before any POA&M closeout.	CAP v2.0

Domain 3: CMMC Governance and Source Documents (15%)

Front	Back	Source
Which two rules carry the CMMC Program?	The 32 CFR Part 170 CMMC Program rule and the 48 CFR part 204 CMMC Acquisition rule in the DFARS.	CMMC final rule, preamble
Which systems, though operated by contractors and holding CUI, lie outside the CMMC Program's requirements?	Federal information systems operated by contractors or subcontractors on behalf of the Government.	32 CFR Part 170
Which version of NIST SP 800-171 applies to a covered contractor information system under DFARS 252.204-7012?	The version in effect when the solicitation is issued, or as authorized by the Contracting Officer.	DFARS 252.204-7012
Which three requirement families does NIST SP 800-171 leave out under its tailoring criteria?	Contingency planning, system and services acquisition, and planning.	NIST SP 800-171 Rev 2
Which three NIST SP 800-171 requirements does PE.L1-b.1.ix map to?	3.10.3 Escort Visitors, 3.10.4 Physical Access Logs and 3.10.5 Manage Physical Access.	32 CFR Part 170
In a Level 1 self-assessment, what replaces CUI wherever a NIST SP 800-171A objective mentions it?	FCI.	32 CFR Part 170
Whose regulation supplies the definition of CUI that the CMMC Program adopts?	NARA's CUI Program rule, 32 CFR Part 2002; the CMMC rule adopts it without change.	32 CFR Part 170
How does 32 CFR Part 2002 reach contractors and other non-executive branch entities?	Indirectly, through incorporation into agreements such as contracts.	32 CFR Part 2002
What happens to a Level 2 or Level 3 assessment when the annual affirmation is missed?	The assessment lapses.	CMMC final rule, preamble
Why can a DoD CMMC guide never override a requirement of 32 CFR Part 170?	The guides are not codified in the CFR: only the rule's text can set program requirements, so the rule takes precedence.	CMMC final rule, preamble

Domain 4: CMMC Model Construct and Implementation Evaluation (35%)

Front	Back	Source
How many of the 14 domains hold Level 1 practices?	Six; the other eight begin at Level 2.	CMMC Model Overview
Which domain holds the most Level 2 requirements?	Access Control (AC), with 22.	CMMC Model Overview
What standing do the assessment objectives have as criteria for a CMMC requirement?	They are authoritative and provide the basis for assessing the requirement.	Level 1 Assessment Guide
What does an assessment determine about security controls, in 32 CFR Part 170's definition?	The extent to which they are implemented correctly, operating as intended, and producing the desired outcome.	32 CFR Part 170
What do N/A findings on some of a requirement's objectives imply about whether the requirement applies?	Nothing by themselves: the requirement can still be applicable.	Level 1 Assessment Guide
To which three kinds of entity does AC.L1-3.1.1 limit information system access?	Authorized users, processes acting on behalf of authorized users, and devices, including other information systems.	FAR 52.204-21
Which two kinds of devices are named as examples of external systems?	Personally owned systems, components or devices, and privately owned computing and communications devices in commercial or public facilities.	NIST SP 800-171 Rev 2
What must be done to information system media containing FCI before disposal or release for reuse?	Sanitize or destroy it.	FAR 52.204-21
Which three groups of people does the Limit Physical Access requirement apply to?	Employees, individuals with permanent physical access authorization credentials, and visitors.	NIST SP 800-171 Rev 2
At which two kinds of boundary must organizational communications be monitored, controlled and protected?	The external boundaries and the key internal boundaries of the information systems.	FAR 52.204-21

Domain 5: the CMMC Assessment Process (25%)

Front	Back	Source
What does the CAP place before Phase 1 of a Level 2 certification assessment?	Preliminary proceedings: administrative, framing and contractual activities between the C3PAO and the OSC.	CAP v2.0
Which span does a Certificate of CMMC Status give as the dates of assessment?	From the beginning of Phase 1 to the date of the Out-Brief Meeting.	CAP v2.0
For what three qualities do C3PAO personnel review the OSC's system security plan in Phase 1?	Completeness, accuracy and consistency.	CAP v2.0
What kind of sampling approach does the team use in a Level 2 certification assessment?	A nonstatistical approach.	CAP v2.0
Which four parties must attend the In-Brief Meeting, at a minimum?	The Lead CCA, the Affirming Official, the OSC POC and the Assessment Team members.	CAP v2.0
When should the team increase its sample of evidence for a requirement?	Once it meets questionable, insufficient or inadequate evidence for that requirement.	CAP v2.0
For a security requirement marked N/A, what is it best practice to record?	A statement explaining why the requirement does not apply to the OSA.	Level 2 Assessment Guide
What interaction is barred to the CCA performing the quality assurance review, before that review?	Any interaction with the Assessment Team about the conduct of the assessment while it is in progress.	CAP v2.0
What does a POA&M closeout assessment assess?	Only the NOT MET requirements that were identified with POA&M in the initial assessment.	32 CFR Part 170
Which C3PAO may an OSC engage to close out its Level 2 POA&M?	Any authorized or accredited C3PAO, including one other than the C3PAO that conducted Phases 1 to 3.	CAP v2.0

Domain 6: Scoping (15%)

Front	Back	Source
What does it mean for an asset to process FCI?	The asset uses the FCI, for example by accessing, editing or printing it.	32 CFR Part 170
Which four network appliances are given as examples of technology for Level 1 scoping?	Firewalls, switches, access points (APs) and routers.	Level 1 Scoping Guide
For which information systems does DFARS clause 252.204-7021 require a current CMMC status?	All information systems used in performance of the contract that process, store or transmit FCI or CUI.	DFARS 252.204-7021
Besides Government Furnished Equipment, which four kinds of asset are Specialized Assets?	IoT or IIoT, Operational Technology (OT), Restricted Information Systems, and Test Equipment.	32 CFR Part 170
Which two features do all Specialized Assets share?	They can process, store or transmit FCI or CUI, and they are unable to be fully secured.	32 CFR Part 170
Which four things should an OSA consider when scoping a Level 1 self-assessment?	The people, technology, facilities and External Service Providers within its environment that process, store or transmit FCI.	32 CFR Part 170
Which four groups of people may Level 1 scoping cover?	Employees, contractors, vendors, and external service provider personnel.	Level 1 Scoping Guide
Which assets fall outside the CMMC Program's scope even when they contain CUI?	Classified assets.	Level 2 Scoping Guide
Which four asset categories make up the Level 2 CMMC Assessment Scope?	CUI Assets, Security Protection Assets, Contractor Risk Managed Assets and Specialized Assets.	Level 2 Scoping Guide
In which three documents must an OSA record every in-scope asset category at Level 2?	The asset inventory, the SSP and the network diagram of the CMMC Assessment Scope.	Level 2 Scoping Guide

Then the other 1,100

Sixty cards cover the facts a candidate is most often asked to produce cold. The full bank is 1,163 cards across the 49 lessons, one set per lesson, each card with its citation, and the Domain 1 cards are open with a free account. The site's card runner schedules them by spaced repetition: a card you rate as easy comes back later, a card you rate as hard comes back sooner, so the time goes where the gaps are. Practice questions are the other half of the pair: recognition under the exam's format, with the explanation under each answer.

By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.