Skip to content

CCP
Practice

CCP practice questions

20 questions, free to answer. Each one says which document it came from.

1. A contractor engages a firm to help remediate gaps ahead of a CMMC Level 2 certification assessment. Which role does that firm hold, and what does it prevent?

A Registered Provider Organization, which may not then conduct the certification assessmentA C3PAO, which may conduct the assessment because it already knows the environmentThe CAICO, which certifies the contractor directly once remediation is completeA Licensed Partner Publisher, which may assess if its practitioners hold CCP

2. During an assessment a CCP recognises that the OSC is a direct competitor of their own employer. What does the Code require?

Report the OSC to the CAICO before proceedingDisclose the conflict and withdraw unless it can be demonstrably managedContinue, because the CCP is a team member rather than the Lead AssessorContinue but exclude themselves from scoring any single practice

3. An OSC handles FCI but no CUI. Which set of security requirements applies?

Both the 15 basic requirements and a subset of NIST SP 800-171The 15 requirements in 48 CFR 52.204-21The 110 requirements in NIST SP 800-171The 17 practices defined under CMMC Level 1

4. Which statement correctly distinguishes FCI from CUI?

FCI is not intended for public release; CUI additionally requires safeguarding or dissemination controls under law, regulation or Government-wide policyFCI is classified at a lower level than CUICUI applies only to information generated by the Government, never by a contractorFCI applies only to information marked by the contracting officer

5. DFARS 252.204-7012 is best described as which of the following?

The NIST publication listing the Level 2 security requirementsThe rule establishing the CAICOA contract clause imposing safeguarding and cyber incident reporting obligations on the contractorThe statute that created the CMMC program

6. How many security requirements does CMMC Level 2 incorporate?

1517171110

7. What determines which CMMC level applies to a given contract?

The dollar value of the contractThe number of employees the contractor hasWhether the contractor has previously held a certificateThe type of information involved — FCI or CUI

8. Which source document contains the assessment objectives used to determine whether a Level 2 requirement is met?

DFARS 252.204-7012NIST SP 800-171ANIST SP 800-17148 CFR 52.204-21

9. An assessor reviews a written policy, asks the system administrator how it is applied, and observes the control operating. Which methods has the assessor used?

Examine, interview and testExamine and interview onlyInterview and test onlyTest only

10. A Level 2 requirement has five assessment objectives. Four are met and one is not. How is the requirement scored?

Partially metMet, with a finding recordedNot applicableNot met

11. An OSC offers a screenshot of one workstation’s configuration as evidence that a setting is enforced across 400 endpoints. What is the deficiency?

It is neither adequate nor sufficient, because screenshots cannot be examinedThere is no deficiency if the workstation was chosen at randomIt is not sufficient, because it does not cover the assessment scopeIt is not adequate, because a screenshot is never acceptable evidence

12. Which best describes the CCP’s responsibility regarding evidence during a Level 2 assessment?

Collect evidence on the OSC’s behalf to speed the assessmentCertify that the evidence satisfies the contractAnalyse its location, collection, quality and usage in support of the assessment teamIndependently determine the final score for each requirement

13. How many phases does the CMMC Assessment Process define, and what is the first?

Four; Conduct the Pre-AssessmentThree; Plan the AssessmentFour; Assess Conformity to Security RequirementsFive; Prepare the Assessment Plan

14. In which phase is the certificate issued and any POA&M closed out?

Phase 2Phase 1Phase 4Phase 3

15. Reporting assessment results falls within which phase?

Phase 1Phase 2Phase 4Phase 3

16. Which activity is outside the CCP’s role on a Level 2 assessment team?

Analysing evidence against assessment objectivesContributing to preparation of the assessment reportMaking the final determination that a requirement is metAssisting with preparation of the assessment plan

17. What is a POA&M used for following a Level 2 certification assessment?

Recording the OSC’s objections to the assessment findingsDocumenting the assessment team’s conflicts of interestListing assets excluded from the assessment scopeTracking remaining requirements to closure within the permitted window

18. When is assessment scope determined?

After evidence collection is completeDuring the closeout of the POA&MOnly if the OSC disputes a findingBefore conformity to requirements is assessed

19. Which document defines the asset categories used when scoping a Level 2 assessment?

CMMC Level 1 Scoping GuideNIST SP 800-171ADFARS 252.204-7012CMMC Level 2 Scoping Guide

20. An OSC handling only FCI is determining scope. Which assets are in scope?

Only assets located in Government facilitiesThose that process, store or transmit FCIEvery asset the OSC ownsOnly assets connected to the internet

About Editorial policy AI policy Contact Privacy Terms Refunds Cookies

QualExam is an independent study resource. It is not affiliated with, endorsed by, or sponsored by any awarding body, and holds no authority to certify anyone. Exam names and marks belong to their respective owners and are used to identify the exams this site prepares people for.

Published by Vishwen Labs (OPC) Private Limited · support@qualexam.com