CMMC CCP 2026 Practice Exam AND STUDY GUIDE 130 QUESTIONS AND
CORRECT ANSWERS WITH RATIONALES COVERING THE MOST TESTED
QUESTIONS
OVERVIEW
ThiscvexamcvfocusescvoncvCMMCcvandcvCUIcvcompliance,cvcoveringcvthecvidentification,c
vdocumentation,cvandcvprotectioncvofcvControlledcvUnclassifiedcvInformationcv(CUI)cvandc
vFederalcvContractcvInformationcv(FCI).cvKeycvtopicscvincludecvthecvdefinitioncvofcvCUIcvas
sets,cvspecializedcvassets,cvandcvtheirc v documentationcvincvAssetcvInventories,cvSystemcv
SecuritycvPlanscv(SSP),cvandcvnetworkcvdiagrams.cvItcvaddressescvCMMCcvlevels,cvwithcvLe
velcv2cvaligningcvwithcvNISTcvSPcv800-
171cvandcvrequiringcv110cvcontrols,cvthecvimportancecvofcvImpactcvLevelcv4cv(IL4)cvforcvs
toringcvCUI,cvandcvthecvfoundationalcvLevelcv1cvrequirements.cvThecvexamcvalsocvtestscvu
nderstandingcvofcvcodingcvwithincvCMMCcvpracticescv(e.g.,cvdomain,cvlevel,cvandcvcontrol
cvnumbers),cvassessmentcvobjectivescvandcvmethods,cvandcvsecuritycvprinciplescvsuchcvas
cvconfidentiality,cvintegrity,cvandcvreciprocity.cvAdditionally,cvitcvcoverscvFedRAMPcvbaseli
nes,cvassessmentcvprocedures,cvandcvthecvdifferencescvbetweencvCUI,cvFCI,cvandcvspecializ
edcvassets,cvemphasizingcvpropercvgovernancecvandcvverificationcvtocvensurecvcybersecurit
ycvcompliancecvincvDoDcvandcvfederalcvcontractingcvenvironments.
1. WhatcviscvacvCUIcvAsset?
A. Assetcvusedcvforcvpubliccvdatacvstorage
B. Assetcvthatcvstores,cvprocesses,cvorcvtransmitscvCUI
C. Assetcvusedcvonlycvforcvbackups
D. Assetcvthatcvstorescvencryptedcvemailscvonly
CorrectcvAnswer:cvBcvRati
onale:
AcvCUIcvassetcviscvanycvsystemcvthatcvstores,cvprocesses,cvorcvtransmitscvControlledcvUnclassified
cvInformationcv(CUI).cvThiscvincludescvservers,cvendpoints,cvcloudcvservices,cvetc.
2. WherecvdocvyoucvdocumentcvacvCUIcvAsset?
A. OnlycvincvSSP
B. OnlycvincvAssetcvInventory
C. AssetcvInventory,cvSSP,cvandcvNetworkcvDiagram
D. OnlycvincvNetworkcvDiagram
CorrectcvAnswer:cvC
,Rationale:
CUIcvassetscvmustcvbecvdocumentedcvincvallcvthreecvlocationscvtocvensurecvvisibility,cvtraceability
,cvandcvpropercvscopingcvforcvassessments.
3. WhatcvpracticescvapplycvtocvacvCUIcvAsset?
A. CMMCcvLevelcv1
B. CMMCcvLevelcv2
C. CMMCcvLevelcv3
D. ISOcv27001cvonly
CorrectcvAnswer:cvBcvRati
onale:
CUIcvrequirescvCMMCcvLevelcv2cvprotections,cvwhichcvaligncvwithcvNISTcvSPcv800-171cvcontrols.
4. WhatcvdoescvCMMCcvstandcvfor?
A. CybercvManagementcvMaturitycvModelcvCertification
B. CybersecuritycvMonitoringcvModelcvCertification
C. CybersecuritycvMaturitycvModelcvCertification
D. CybersecuritycvMechanismcvModelcvCertification
CorrectcvAnswer:cvCcvRati
onale:
CMMCcv=cvCybersecuritycvMaturitycvModelcvCertification,cvthecvDoDcvframeworkcvforcvcontractorc
vcybersecurity.
5. HowcvmanycvcontrolscvarecvincvCMMCcvLevelcv2?
A. 17
B. 72
C. 110
D. 130
CorrectcvAnswer:cvCcvRati
onale:
CMMCcvLevelcv2cvalignscvwithcv110cvcontrolscvfromcvNISTcvSPcv800-171.
6. WhatcvimpactcvlevelcviscvrequiredcvwhencvstoringcvCUI?
A. IL2
B. IL3
,C. IL4
D. IL5
CorrectcvAnswer:cvCcvRati
onale:
CUIcvmustcvbecvstoredcvatcvImpactcvLevelcv4cv(IL4)cvorcvequivalent.
7. WhatcvcontractcvclausecviscvusedcvforcvCMMCcvLevelcv1?
A. DFARScv7012
B. FARcv52.204-21
C. DFARScv7020
D. FARcv15.204
CorrectcvAnswer:cvBcvRati
onale:
FARcv52.204-21cvdefinescvthecv17cvbasiccvsafeguardingcvrequirementscvforcvFCIcv(Levelcv1).
8. DocvyoucvneedcvCMMCcvLevelcv1cvtocvbecvLevelcv2cvcompliant?
A. No
B. Yes
C. Onlycvforcvfederalcvagencies
D. Onlycvforcvcloudcvproviders
CorrectcvAnswer:cvBcvRati
onale:
Levelcv2cvbuildscvoncvLevelcv1cv—cvsocvyes,cvLevelcv1cviscvincluded.
9. IncvAC.L1-3.1.1,cvwhatcviscv“AC”?
A. Level
B. Controlcvnumber
C. Domain
D. Assessmentcvtype
CorrectcvAnswer:cvCcvRati
onale:
“AC”cvstandscvforcvAccesscvControl,cvwhichcviscvthecvdomain.
10. IncvAC.L1-3.1.1,cvwhatcviscv“L1”?
, A. Domain
B. Level
C. Controlcvfamily
D. Practicecvnumber
CorrectcvAnswer:cvBcvRati
onale:
“L1”cvindicatescvLevelcv1.
11. IncvAC.L1-3.1.1,cvwhatcviscv“3.1.1”?
A. Domain
B. Level
C. SecuritycvPracticecvNumber
D. PolicycvID
CorrectcvAnswer:cvCcvRati
onale:
Thiscvrepresentscvthecvspecificcvcontrol/practicecvnumber.
12. Whatcviscvconfidentiality?
A. Datacvbackupcvprocess
B. Ensuringcvsystemcvuptime
C. Protectingcvinformationcvfromcvunauthorizedcvaccess
D. Encryptingcvonlycvemails
CorrectcvAnswer:cvCcvRati
onale:
Confidentialitycvensurescvonlycvauthorizedcvuserscvcancvaccesscvinformation.
13. Whatcviscvfilecvintegrity?
A. Datacvencryption
B. Preventingcvunauthorizedcvmodificationcvorcvdestruction
C. Filecvcompression
D. Backupcvscheduling
CorrectcvAnswer:cvBcvRati
onale:
Integritycvensurescvdatacviscvnotcvalteredcvorcvdestroyedcvimproperly.
CORRECT ANSWERS WITH RATIONALES COVERING THE MOST TESTED
QUESTIONS
OVERVIEW
ThiscvexamcvfocusescvoncvCMMCcvandcvCUIcvcompliance,cvcoveringcvthecvidentification,c
vdocumentation,cvandcvprotectioncvofcvControlledcvUnclassifiedcvInformationcv(CUI)cvandc
vFederalcvContractcvInformationcv(FCI).cvKeycvtopicscvincludecvthecvdefinitioncvofcvCUIcvas
sets,cvspecializedcvassets,cvandcvtheirc v documentationcvincvAssetcvInventories,cvSystemcv
SecuritycvPlanscv(SSP),cvandcvnetworkcvdiagrams.cvItcvaddressescvCMMCcvlevels,cvwithcvLe
velcv2cvaligningcvwithcvNISTcvSPcv800-
171cvandcvrequiringcv110cvcontrols,cvthecvimportancecvofcvImpactcvLevelcv4cv(IL4)cvforcvs
toringcvCUI,cvandcvthecvfoundationalcvLevelcv1cvrequirements.cvThecvexamcvalsocvtestscvu
nderstandingcvofcvcodingcvwithincvCMMCcvpracticescv(e.g.,cvdomain,cvlevel,cvandcvcontrol
cvnumbers),cvassessmentcvobjectivescvandcvmethods,cvandcvsecuritycvprinciplescvsuchcvas
cvconfidentiality,cvintegrity,cvandcvreciprocity.cvAdditionally,cvitcvcoverscvFedRAMPcvbaseli
nes,cvassessmentcvprocedures,cvandcvthecvdifferencescvbetweencvCUI,cvFCI,cvandcvspecializ
edcvassets,cvemphasizingcvpropercvgovernancecvandcvverificationcvtocvensurecvcybersecurit
ycvcompliancecvincvDoDcvandcvfederalcvcontractingcvenvironments.
1. WhatcviscvacvCUIcvAsset?
A. Assetcvusedcvforcvpubliccvdatacvstorage
B. Assetcvthatcvstores,cvprocesses,cvorcvtransmitscvCUI
C. Assetcvusedcvonlycvforcvbackups
D. Assetcvthatcvstorescvencryptedcvemailscvonly
CorrectcvAnswer:cvBcvRati
onale:
AcvCUIcvassetcviscvanycvsystemcvthatcvstores,cvprocesses,cvorcvtransmitscvControlledcvUnclassified
cvInformationcv(CUI).cvThiscvincludescvservers,cvendpoints,cvcloudcvservices,cvetc.
2. WherecvdocvyoucvdocumentcvacvCUIcvAsset?
A. OnlycvincvSSP
B. OnlycvincvAssetcvInventory
C. AssetcvInventory,cvSSP,cvandcvNetworkcvDiagram
D. OnlycvincvNetworkcvDiagram
CorrectcvAnswer:cvC
,Rationale:
CUIcvassetscvmustcvbecvdocumentedcvincvallcvthreecvlocationscvtocvensurecvvisibility,cvtraceability
,cvandcvpropercvscopingcvforcvassessments.
3. WhatcvpracticescvapplycvtocvacvCUIcvAsset?
A. CMMCcvLevelcv1
B. CMMCcvLevelcv2
C. CMMCcvLevelcv3
D. ISOcv27001cvonly
CorrectcvAnswer:cvBcvRati
onale:
CUIcvrequirescvCMMCcvLevelcv2cvprotections,cvwhichcvaligncvwithcvNISTcvSPcv800-171cvcontrols.
4. WhatcvdoescvCMMCcvstandcvfor?
A. CybercvManagementcvMaturitycvModelcvCertification
B. CybersecuritycvMonitoringcvModelcvCertification
C. CybersecuritycvMaturitycvModelcvCertification
D. CybersecuritycvMechanismcvModelcvCertification
CorrectcvAnswer:cvCcvRati
onale:
CMMCcv=cvCybersecuritycvMaturitycvModelcvCertification,cvthecvDoDcvframeworkcvforcvcontractorc
vcybersecurity.
5. HowcvmanycvcontrolscvarecvincvCMMCcvLevelcv2?
A. 17
B. 72
C. 110
D. 130
CorrectcvAnswer:cvCcvRati
onale:
CMMCcvLevelcv2cvalignscvwithcv110cvcontrolscvfromcvNISTcvSPcv800-171.
6. WhatcvimpactcvlevelcviscvrequiredcvwhencvstoringcvCUI?
A. IL2
B. IL3
,C. IL4
D. IL5
CorrectcvAnswer:cvCcvRati
onale:
CUIcvmustcvbecvstoredcvatcvImpactcvLevelcv4cv(IL4)cvorcvequivalent.
7. WhatcvcontractcvclausecviscvusedcvforcvCMMCcvLevelcv1?
A. DFARScv7012
B. FARcv52.204-21
C. DFARScv7020
D. FARcv15.204
CorrectcvAnswer:cvBcvRati
onale:
FARcv52.204-21cvdefinescvthecv17cvbasiccvsafeguardingcvrequirementscvforcvFCIcv(Levelcv1).
8. DocvyoucvneedcvCMMCcvLevelcv1cvtocvbecvLevelcv2cvcompliant?
A. No
B. Yes
C. Onlycvforcvfederalcvagencies
D. Onlycvforcvcloudcvproviders
CorrectcvAnswer:cvBcvRati
onale:
Levelcv2cvbuildscvoncvLevelcv1cv—cvsocvyes,cvLevelcv1cviscvincluded.
9. IncvAC.L1-3.1.1,cvwhatcviscv“AC”?
A. Level
B. Controlcvnumber
C. Domain
D. Assessmentcvtype
CorrectcvAnswer:cvCcvRati
onale:
“AC”cvstandscvforcvAccesscvControl,cvwhichcviscvthecvdomain.
10. IncvAC.L1-3.1.1,cvwhatcviscv“L1”?
, A. Domain
B. Level
C. Controlcvfamily
D. Practicecvnumber
CorrectcvAnswer:cvBcvRati
onale:
“L1”cvindicatescvLevelcv1.
11. IncvAC.L1-3.1.1,cvwhatcviscv“3.1.1”?
A. Domain
B. Level
C. SecuritycvPracticecvNumber
D. PolicycvID
CorrectcvAnswer:cvCcvRati
onale:
Thiscvrepresentscvthecvspecificcvcontrol/practicecvnumber.
12. Whatcviscvconfidentiality?
A. Datacvbackupcvprocess
B. Ensuringcvsystemcvuptime
C. Protectingcvinformationcvfromcvunauthorizedcvaccess
D. Encryptingcvonlycvemails
CorrectcvAnswer:cvCcvRati
onale:
Confidentialitycvensurescvonlycvauthorizedcvuserscvcancvaccesscvinformation.
13. Whatcviscvfilecvintegrity?
A. Datacvencryption
B. Preventingcvunauthorizedcvmodificationcvorcvdestruction
C. Filecvcompression
D. Backupcvscheduling
CorrectcvAnswer:cvBcvRati
onale:
Integritycvensurescvdatacviscvnotcvalteredcvorcvdestroyedcvimproperly.
