CMMC CCP Practice Exam Questions and Answers Rated A
Asset that stores, processes, or transmits CUI
What is a CUI Asset? Examples: Servers, Printers, Endpoints, Cloud Services,
ERP Systems
Document in Asset Inventory
Where do you document a CUI Asset? Document in SSP
Document in Network Diagram
What practices do you apply to a CUI Asset? CMMC Level 2
What does CMMC stand for? Cybersecurity Maturity Model Certification
How many controls are in CMMC L2? 110 controls
What impact level is required when storing CUI? IL4
What contract clause is used for CMMC L1? FAR 52.204-21 (17 practices in total)
If you want to be CMMC L2 compliant, do you need to also
Yes
be CMMC L1 compliant?
What do you call the part before the first period in the
Domain
following control? AC.L1-3.1.1
What do you call the part after the first period in the
Level
following control? AC.L1-3.1.1
What do you call the part after the dash in the following
Security Practice Number
control? AC.L1-3.1.1
Information Access and disclosure includes means for
What is confidentiality?
protecting personal privacy and proprietary information.
Stored information is suflciently guarded against modifi-
What is file integrity?
cation or destruction.
Low
What are the three levels of FedRAMP? Moderate
High
, Privileges granted by one organization to another for mu-
What is reciprocity?
tual benefit.
Identify the specific items being assessed and can include
specifications, mechanism, activities, and individuals to re-
ceive MET for the practice as defined in NIST SP 800-171A
What is an Assessment Objective?
Means to gain detailed insight about practices imple-
mented in and by the OSC and how those practices are
performed
1. Identifier and Practice Statement
2. Assessment Objectives
3. Potential Assessment Methods and Objects
What are the six components of a CMMC practice?
4. Discussion
5. Further Discussion
6. Key References
Consists of an Assessment Objective and a set of potential
What is an Assessment Procedure?
assessment methods
*Examine
*Interview
What is an Assessment Method? *Test
The nature and extent of the Assessors action
1. Not intended for public release
2. It is provided by or for the government
What are the three characteristics of FCI?
3. It is not transactional bidding information or publicly
released information
Is all CUI considered FCI? Yes
What is a Specialized Asset (SA)?
, May or may not have CUI - specialized equipment that
can't be updated
Example: Government Property, Operational Tech, Test
Equipment, CNC Machine
Document in Asset Inventory
What three places do you need to document an SA? Document in SSP
Document in Network Diagram
What is a specialized asset assessed against in L2? Assessed against CA.L2-3.12.4 (The SSP)
Assets that provide security functions or capabilities to the
contractor's CMMC Assessment Scope
What is a Security Protection Asset (SPA) for CUI? Support CMMC Compliance state
Examples - SIEM, EndPoint Protection Tools, Protect Assets
that have CUI, Enterprise Admin, MSP
What is it called when a portion of the company infrastruc-
Enclaving (Host unit)
ture is separate from the rest of the company?
Where does an OSC register to be issued a UEI and CAGE
SAM.gov
code?
Document in Asset Inventory
What three places do you need to document a SPA? Document in SSP
Document in Network Diagram
How many phases are in the CAP? 4
How many phases are in the CAP? 4 Phases
Asset that stores, processes, or transmits CUI
What is a CUI Asset? Examples: Servers, Printers, Endpoints, Cloud Services,
ERP Systems
Document in Asset Inventory
Where do you document a CUI Asset? Document in SSP
Document in Network Diagram
What practices do you apply to a CUI Asset? CMMC Level 2
What does CMMC stand for? Cybersecurity Maturity Model Certification
How many controls are in CMMC L2? 110 controls
What impact level is required when storing CUI? IL4
What contract clause is used for CMMC L1? FAR 52.204-21 (17 practices in total)
If you want to be CMMC L2 compliant, do you need to also
Yes
be CMMC L1 compliant?
What do you call the part before the first period in the
Domain
following control? AC.L1-3.1.1
What do you call the part after the first period in the
Level
following control? AC.L1-3.1.1
What do you call the part after the dash in the following
Security Practice Number
control? AC.L1-3.1.1
Information Access and disclosure includes means for
What is confidentiality?
protecting personal privacy and proprietary information.
Stored information is suflciently guarded against modifi-
What is file integrity?
cation or destruction.
Low
What are the three levels of FedRAMP? Moderate
High
, Privileges granted by one organization to another for mu-
What is reciprocity?
tual benefit.
Identify the specific items being assessed and can include
specifications, mechanism, activities, and individuals to re-
ceive MET for the practice as defined in NIST SP 800-171A
What is an Assessment Objective?
Means to gain detailed insight about practices imple-
mented in and by the OSC and how those practices are
performed
1. Identifier and Practice Statement
2. Assessment Objectives
3. Potential Assessment Methods and Objects
What are the six components of a CMMC practice?
4. Discussion
5. Further Discussion
6. Key References
Consists of an Assessment Objective and a set of potential
What is an Assessment Procedure?
assessment methods
*Examine
*Interview
What is an Assessment Method? *Test
The nature and extent of the Assessors action
1. Not intended for public release
2. It is provided by or for the government
What are the three characteristics of FCI?
3. It is not transactional bidding information or publicly
released information
Is all CUI considered FCI? Yes
What is a Specialized Asset (SA)?
, May or may not have CUI - specialized equipment that
can't be updated
Example: Government Property, Operational Tech, Test
Equipment, CNC Machine
Document in Asset Inventory
What three places do you need to document an SA? Document in SSP
Document in Network Diagram
What is a specialized asset assessed against in L2? Assessed against CA.L2-3.12.4 (The SSP)
Assets that provide security functions or capabilities to the
contractor's CMMC Assessment Scope
What is a Security Protection Asset (SPA) for CUI? Support CMMC Compliance state
Examples - SIEM, EndPoint Protection Tools, Protect Assets
that have CUI, Enterprise Admin, MSP
What is it called when a portion of the company infrastruc-
Enclaving (Host unit)
ture is separate from the rest of the company?
Where does an OSC register to be issued a UEI and CAGE
SAM.gov
code?
Document in Asset Inventory
What three places do you need to document a SPA? Document in SSP
Document in Network Diagram
How many phases are in the CAP? 4
How many phases are in the CAP? 4 Phases
