CMMC CCP PRACTICE EXAM QUESTIONS
(DERIVED FROM SHANE'S PRACTICE
TEST AND DIRECTLY FROM THE CAP)
QUESTIONS WITH COMPLETE
SOLUTIONS!!
What is a CUI Asset? Answer - Asset that stores, processes, or transmits CUI
Examples: Servers, Printers, Endpoints, Cloud Services, ERP Systems
Where do you document a CUI Asset? Answer - Document in Asset Inventory
Document in SSP
Document in Network Diagram
What practices do you apply to a CUI Asset? Answer - CMMC Level 2
What does CMMC stand for? Answer - Cybersecurity Maturity Model Certification
How many controls are in CMMC L2? Answer - 110 controls
What impact level is required when storing CUI? Answer - IL4
What contract clause is used for CMMC L1? Answer - FAR 52.204-21 (17 practices
in total)
If you want to be CMMC L2 compliant, do you need to also be CMMC L1 compliant?
Answer - Yes
What do you call the part before the first period in the following control? AC.L1-3.1.1
Answer - Domain
What do you call the part after the first period in the following control? AC.L1-3.1.1
Answer - Level
What do you call the part after the dash in the following control? AC.L1-3.1.1 Answer
- Security Practice Number
What is confidentiality? Answer - Information Access and disclosure includes means
for protecting personal privacy and proprietary information.
,What is file integrity? Answer - Stored information is sufficiently guarded against
modification or destruction.
What are the three levels of FedRAMP? Answer - Low
Moderate
High
What is reciprocity? Answer - Privileges granted by one organization to another for
mutual benefit.
What is an Assessment Objective? Answer - Identify the specific items being
assessed and can include specifications, mechanism, activities, and individuals to
receive MET for the practice as defined in NIST SP 800-171A
Means to gain detailed insight about practices implemented in and by the OSC and
how those practices are performed
What are the six components of a CMMC practice? Answer - 1. Identifier and
Practice Statement
2. Assessment Objectives
3. Potential Assessment Methods and Objects
4. Discussion
5. Further Discussion
6. Key References
What is an Assessment Procedure? Answer - Consists of an Assessment Objective
and a set of potential assessment methods
What is an Assessment Method? Answer - *Examine
*Interview
*Test
The nature and extent of the Assessors action
What are the three characteristics of FCI? Answer - 1. Not intended for public
release
2. It is provided by or for the government
3. It is not transactional bidding information or publicly released information
Is all CUI considered FCI? Answer - Yes
What is a Specialized Asset (SA)? Answer - May or may not have CUI - specialized
equipment that can't be updated
Example: Government Property, Operational Tech, Test Equipment, CNC Machine
What three places do you need to document an SA? Answer - Document in Asset
Inventory
, Document in SSP
Document in Network Diagram
What is a specialized asset assessed against in L2? Answer - Assessed against
CA.L2-3.12.4 (The SSP)
What is a Security Protection Asset (SPA) for CUI? Answer - Assets that provide
security functions or capabilities to the contractor's CMMC Assessment Scope
Support CMMC Compliance state
Examples - SIEM, EndPoint Protection Tools, Protect Assets that have CUI,
Enterprise Admin, MSP
What is it called when a portion of the company infrastructure is separate from the
rest of the company? Answer - Enclaving (Host unit)
Where does an OSC register to be issued a UEI and CAGE code? Answer -
SAM.gov
What three places do you need to document a SPA? Answer - Document in Asset
Inventory
Document in SSP
Document in Network Diagram
How many phases are in the CAP? Answer - 4
How many phases are in the CAP? Answer - 4 Phases
What are the phases of the CAP? Answer - 1. Plan and prepare
2. Conduct
3. Report Assessment
4. Close out POAMs
Where are the results of a CMMC assessment uploaded and stored? Answer -
CMMC eMass
How do you protect the findings from a CMMC assessment? Answer - The CMMC
artifact Hashing Tool
How quickly should a C3PAO respond to an OSC? Answer - 5 business days
What is an OSC Assessment Official? Answer - The most senior representative of an
OSC who is directly and actively responsible for leading and managing the OSCs
engagement
(DERIVED FROM SHANE'S PRACTICE
TEST AND DIRECTLY FROM THE CAP)
QUESTIONS WITH COMPLETE
SOLUTIONS!!
What is a CUI Asset? Answer - Asset that stores, processes, or transmits CUI
Examples: Servers, Printers, Endpoints, Cloud Services, ERP Systems
Where do you document a CUI Asset? Answer - Document in Asset Inventory
Document in SSP
Document in Network Diagram
What practices do you apply to a CUI Asset? Answer - CMMC Level 2
What does CMMC stand for? Answer - Cybersecurity Maturity Model Certification
How many controls are in CMMC L2? Answer - 110 controls
What impact level is required when storing CUI? Answer - IL4
What contract clause is used for CMMC L1? Answer - FAR 52.204-21 (17 practices
in total)
If you want to be CMMC L2 compliant, do you need to also be CMMC L1 compliant?
Answer - Yes
What do you call the part before the first period in the following control? AC.L1-3.1.1
Answer - Domain
What do you call the part after the first period in the following control? AC.L1-3.1.1
Answer - Level
What do you call the part after the dash in the following control? AC.L1-3.1.1 Answer
- Security Practice Number
What is confidentiality? Answer - Information Access and disclosure includes means
for protecting personal privacy and proprietary information.
,What is file integrity? Answer - Stored information is sufficiently guarded against
modification or destruction.
What are the three levels of FedRAMP? Answer - Low
Moderate
High
What is reciprocity? Answer - Privileges granted by one organization to another for
mutual benefit.
What is an Assessment Objective? Answer - Identify the specific items being
assessed and can include specifications, mechanism, activities, and individuals to
receive MET for the practice as defined in NIST SP 800-171A
Means to gain detailed insight about practices implemented in and by the OSC and
how those practices are performed
What are the six components of a CMMC practice? Answer - 1. Identifier and
Practice Statement
2. Assessment Objectives
3. Potential Assessment Methods and Objects
4. Discussion
5. Further Discussion
6. Key References
What is an Assessment Procedure? Answer - Consists of an Assessment Objective
and a set of potential assessment methods
What is an Assessment Method? Answer - *Examine
*Interview
*Test
The nature and extent of the Assessors action
What are the three characteristics of FCI? Answer - 1. Not intended for public
release
2. It is provided by or for the government
3. It is not transactional bidding information or publicly released information
Is all CUI considered FCI? Answer - Yes
What is a Specialized Asset (SA)? Answer - May or may not have CUI - specialized
equipment that can't be updated
Example: Government Property, Operational Tech, Test Equipment, CNC Machine
What three places do you need to document an SA? Answer - Document in Asset
Inventory
, Document in SSP
Document in Network Diagram
What is a specialized asset assessed against in L2? Answer - Assessed against
CA.L2-3.12.4 (The SSP)
What is a Security Protection Asset (SPA) for CUI? Answer - Assets that provide
security functions or capabilities to the contractor's CMMC Assessment Scope
Support CMMC Compliance state
Examples - SIEM, EndPoint Protection Tools, Protect Assets that have CUI,
Enterprise Admin, MSP
What is it called when a portion of the company infrastructure is separate from the
rest of the company? Answer - Enclaving (Host unit)
Where does an OSC register to be issued a UEI and CAGE code? Answer -
SAM.gov
What three places do you need to document a SPA? Answer - Document in Asset
Inventory
Document in SSP
Document in Network Diagram
How many phases are in the CAP? Answer - 4
How many phases are in the CAP? Answer - 4 Phases
What are the phases of the CAP? Answer - 1. Plan and prepare
2. Conduct
3. Report Assessment
4. Close out POAMs
Where are the results of a CMMC assessment uploaded and stored? Answer -
CMMC eMass
How do you protect the findings from a CMMC assessment? Answer - The CMMC
artifact Hashing Tool
How quickly should a C3PAO respond to an OSC? Answer - 5 business days
What is an OSC Assessment Official? Answer - The most senior representative of an
OSC who is directly and actively responsible for leading and managing the OSCs
engagement
