CMMC CCP Practice Exam Questions | UPDATED Questions with
100% Verified Answers
Question: What is a CUI Asset?
Answer:
Asset that stores, processes, or transmits CUI Examples: Servers, Printers, Endpoints, Cloud Services, ERP
Systems
Question: Where do you document a CUI Asset?
Answer:
Document in Asset Inventory Document in SSP Document in Network Diagram
Question: What practices do you apply to a CUI Asset?
Answer:
CMMC Level 2
Question: What does CMMC stand for?
Answer:
Cybersecurity Maturity Model Certification
Question: How many controls are in CMMC L2?
Answer:
110 controls
Question: What impact level is required when storing CUI?
Answer:
IL4
,Question: What contract clause is used for CMMC L1?
Answer:
FAR 52.204-21 (17 practices in total)
Question: If you want to be CMMC L2 compliant, do you need to also be CMMC L1 compliant?
Answer:
Yes
Question: What do you call the part before the first period in the following control? AC.L1-3.1.1
Answer:
Domain
Question: What do you call the part after the first period in the following control? AC.L1-3.1.1
Answer:
Level
Question: What do you call the part after the dash in the following control? AC.L1-3.1.1
Answer:
Security Practice Number
Question: What is confidentiality?
Answer:
Information Access and disclosure includes means for protecting personal privacy and proprietary information.
Question: What is file integrity?
Answer:
Stored information is sufficiently guarded against modification or destruction.
Question: What are the three levels of FedRAMP?
Answer:
Low Moderate High
Question: What is reciprocity?
Answer:
Privileges granted by one organization to another for mutual benefit.
, Question: What is an Assessment Objective?
Answer:
Identify the specific items being assessed and can include specifications, mechanism, activities, and individuals
to receive MET for the practice as defined in NIST SP 800-171A Means to gain detailed insight about practices
implemented in and by the OSC and how those practices are performed
Question: What are the six components of a CMMC practice?
Answer:
1. Identifier and Practice Statement 2. Assessment Objectives 3. Potential Assessment Methods and Objects 4.
Discussion 5. Further Discussion 6. Key References
Question: What is an Assessment Procedure?
Answer:
Consists of an Assessment Objective and a set of potential assessment methods
Question: What is an Assessment Method?
Answer:
*Examine *Interview *Test The nature and extent of the Assessors action
Question: What are the three characteristics of FCI?
Answer:
1. Not intended for public release 2. It is provided by or for the government 3. It is not transactional bidding
information or publicly released information
Question: Is all CUI considered FCI?
Answer:
Yes
Question: What is a Specialized Asset (SA)?
Answer:
May or may not have CUI - specialized equipment that can't be updated Example: Government Property,
Operational Tech, Test Equipment, CNC Machine
Question: What three places do you need to document an SA?
Answer:
Document in Asset Inventory Document in SSP Document in Network Diagram
100% Verified Answers
Question: What is a CUI Asset?
Answer:
Asset that stores, processes, or transmits CUI Examples: Servers, Printers, Endpoints, Cloud Services, ERP
Systems
Question: Where do you document a CUI Asset?
Answer:
Document in Asset Inventory Document in SSP Document in Network Diagram
Question: What practices do you apply to a CUI Asset?
Answer:
CMMC Level 2
Question: What does CMMC stand for?
Answer:
Cybersecurity Maturity Model Certification
Question: How many controls are in CMMC L2?
Answer:
110 controls
Question: What impact level is required when storing CUI?
Answer:
IL4
,Question: What contract clause is used for CMMC L1?
Answer:
FAR 52.204-21 (17 practices in total)
Question: If you want to be CMMC L2 compliant, do you need to also be CMMC L1 compliant?
Answer:
Yes
Question: What do you call the part before the first period in the following control? AC.L1-3.1.1
Answer:
Domain
Question: What do you call the part after the first period in the following control? AC.L1-3.1.1
Answer:
Level
Question: What do you call the part after the dash in the following control? AC.L1-3.1.1
Answer:
Security Practice Number
Question: What is confidentiality?
Answer:
Information Access and disclosure includes means for protecting personal privacy and proprietary information.
Question: What is file integrity?
Answer:
Stored information is sufficiently guarded against modification or destruction.
Question: What are the three levels of FedRAMP?
Answer:
Low Moderate High
Question: What is reciprocity?
Answer:
Privileges granted by one organization to another for mutual benefit.
, Question: What is an Assessment Objective?
Answer:
Identify the specific items being assessed and can include specifications, mechanism, activities, and individuals
to receive MET for the practice as defined in NIST SP 800-171A Means to gain detailed insight about practices
implemented in and by the OSC and how those practices are performed
Question: What are the six components of a CMMC practice?
Answer:
1. Identifier and Practice Statement 2. Assessment Objectives 3. Potential Assessment Methods and Objects 4.
Discussion 5. Further Discussion 6. Key References
Question: What is an Assessment Procedure?
Answer:
Consists of an Assessment Objective and a set of potential assessment methods
Question: What is an Assessment Method?
Answer:
*Examine *Interview *Test The nature and extent of the Assessors action
Question: What are the three characteristics of FCI?
Answer:
1. Not intended for public release 2. It is provided by or for the government 3. It is not transactional bidding
information or publicly released information
Question: Is all CUI considered FCI?
Answer:
Yes
Question: What is a Specialized Asset (SA)?
Answer:
May or may not have CUI - specialized equipment that can't be updated Example: Government Property,
Operational Tech, Test Equipment, CNC Machine
Question: What three places do you need to document an SA?
Answer:
Document in Asset Inventory Document in SSP Document in Network Diagram
