The CMMC Certified Professional (CCP) exam is 170 multiple-choice questions in 3.5 hours, each with a stem, four options and one best answer. ISACA's 2026 candidate guide describes that format in a few lines, and those lines are the whole of what the exam's owner says about its questions in public: as of this writing, neither ISACA, The Cyber AB nor the Department has published sample questions for this exam, and nothing anywhere is honestly presented as a real one. This guide sets out what a CCP question is made of, in the candidate guide's words, gives four original questions in that shape with the answer, the reasoning and the document behind each, explains how the exam turns answers into a score, and says where the course's 1,166 questions are. None of them is printed here: practice is in the app, and the first domain is free with a free account.
How the CCP exam asks a question
The candidate guide sets out the format in a few lines. "All questions are designed with one best answer", and "Every question has a stem (question) and four options (answer choices)." The stem "may be in the form of a question or incomplete statement." The questions below follow the same shape, and so do the questions on the exam.
There is no penalty for a wrong answer. The guide says so directly: "There are no penalties for incorrect answers. Grades are based solely on the total number of questions answered correctly, so do not leave any questions blank." That applies to any practice set too. Pick something for every question.
What a question is made of
Three things decide a CCP question: the document it rests on, the qualifier in its stem, and the distractors around its key.
The document. Every CCP question comes from a published document: 32 CFR Part 170, the CMMC Assessment Process, the Assessment and Scoping Guides, the Code of Professional Conduct, NIST SP 800-171 and 800-171A, or the CUI rule. A question that seems to test opinion is testing a sentence in one of them. The fastest way to improve is to know which document each domain draws on; What to read for the CCP exam lists them by domain.
The qualifier. MOST, BEST and FIRST change the task from recognizing a true statement to ranking several. In a question about roles, three options may name bodies that exist and do real work; the qualifier asks which one the rule assigns the task to. Read the qualifier before the options.
The distractors. The wrong options on a well-written question are true statements about the wrong thing: the right body for a different level, the right count under a different numbering, the right rule applied one step too early. That is why the explanation under each question below says why the others fall short, not only why the key is right.
The weights decide where to practice. ISACA's exam content outline gives Domain 4, CMMC Model Construct and Implementation Evaluation, 35% of the exam, and Domain 5, the CMMC Assessment Process, 25%; the four 5% and 15% domains share the rest. The CCP exam's six domains sets out each.
Four questions in the exam's shape
Each of these is original, written for this guide from the documents the exam is written from, and each ends with the reasoning, as the course's questions do. They come from Domains 1, 3, 4 and 5.
How to read your score
Count what you got right, but do not turn it into a percentage and compare it with the passing score. The exam does not report a percentage. ISACA "uses and reports scores on a common scale from 200 to 800", and "Candidates must receive a score of 450 or higher to pass the exam, which represents the minimum standard of knowledge." The scaled score is a conversion of the raw score that adjusts for differences between versions of the exam, so no fixed number of correct answers maps to 450. The CCP passing score explains the scale and the rescore and retake rules.
What a practice set can show is where you stand by domain. The exam reports domain-level results to candidates who do not pass, "for informational purposes only", because "Exam scores are based on the total number of exam items answered correctly, regardless of domain." A domain where you miss three questions in five is a domain to read before you book. Domain 4 alone is 35% of the exam, about 60 of the 170 questions, and Domain 5 is another 25%, so a weak result in either of those costs more than a weak result in the 5% domains.
Where the course's questions come from
The course holds 1,166 questions across the six domains and 49 lessons, every one written from the documents the exam is written from: 32 CFR Part 170, the CMMC Assessment Process, the Assessment Guides and Scoping Guides for Levels 1 and 2, the Code of Professional Conduct, NIST SP 800-171 and 800-171A, and the CUI rule. The explanation under each answer names the document, and the lesson it belongs to teaches the point with its sources. The questions are checked against those documents when they are written and again when the documents change.
None of them is printed on this site. Questions are read and answered in the app, where your progress is kept and the mock is drawn from the same bank; the four above are the only ones in this guide, and they are not in the course. The first domain, CMMC Ecosystem, is open in full with a free account, lessons, questions and flashcards together, so the format can be tried before anything is paid.
What to do next
- Measure every domain, not four questions of it. The free study plan starts with a baseline of eighteen questions that asks every domain, counts an admitted blank as a gap rather than a guess, and ranks the domains by what each is worth to you on the exam.
- Practice by domain. The course's 1,166 questions cover all six domains across 49 lessons, with the same kind of explanation under every answer; how practice works describes the bank.
- Read the first domain free. The Domain 1 lessons are open in full with a free account, and every lesson ends in its own question set and flashcards.
- Sit a full mock before the exam. A timed 170-question mock, with the domains mixed as they are on the day, is the closest thing to the exam itself.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.