Certified CMMC Professional (CCP) exam with answers
Which of the following is NOT a function of the CMMC Accreditation Body (AB)? - correct answer -
Perform assessments or consulting to Organizations Seeking Certification (OSC)
Which of the following is required to become a CMMC Certified Instructor who teaches CMMC
Certified Assessor (CCA) courses? - correct answer -DoD Tier 3 background check
What is the FIRST action you should take if you witness a Code of Professional Conduct (COPC)
violation? - correct answer -Privately request clarification or offer help to the violator
According to the CMMC AB, which of the following should you NOT do when using methods properly?
- correct answer -Make assertions about exam outcomes or assessments
Other than safeguarding CDI, which of the following is NOT a requirement of DFARS 252.204-7012? -
correct answer -Submit a compliance score to the SPRS
With respect to FEDRAMP, what does CIS stand for? - correct answer -Control Implementation
Summary (CIS)
Which of the following is a CORRECT definition of Controlled Unclassified Information (CUI)? - correct
answer -Information that the Government creates or possesses, or that an entity creates or possesses
for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or
permits an agency to handle using safeguarding or dissemination controls.
What part of Title 32 CFR provides context for safeguarding CUI? - correct answer -2002
Which of the following is NOT an appendix to the CMMC Model Overview? - correct answer -Glossary
Which of the following control framework is NOT included in the CMMC Model's Appendix B - Source
Mapping? - correct answer -PCI DSS
, What prompted the creation of the CUI program? - correct answer -Executive Order 13556
Which resource/ruling provides and defines the basic 15 controls that make up the 17 CMMC Level 1
practices? - correct answer -FAR 52.204-21
What function does DODI 5200.48 and Part 2002 of Title 32 CFR serve? - correct answer -Provides
contractors and authorized holders responsibilities in handling CUI
What is a government authority for identifying and marking CUI? - correct answer -National Archives
and Records Administration (NARA)
Which of the following is a type of CUI? - correct answer -Basic
When analyzing CMMC practices, which of the following is an acceptable way to mark the status of an
assessment objective? - correct answer -Not-applicable
During the pre-assessment phase, where is pre-assessment information uploaded to by the CMMC
Quality Assurance Professional (CQAP)? - correct answer -eMASS
Using the DOD Assessment Methodology (DODAM), how many points are deducted for security
requirements that could lead to significant exploitation of the network, or exfiltration of DoD CUI that
are not met? - correct answer -5
How many practices must be met to move the OSC to the POA&M Close-Out Assessment option? -
correct answer -88
The Assessment package must be submitted to the CQAP NLT __ Business Days from the Final Findings
Briefing and uploaded to eMASS NLT __ Business Days from the Final Findings Briefing. - correct
answer -10, 20
During the planning phase of an assessment, you have finished organizing and preparing assessment
documents and templates. Which of the following would be the next step? - correct answer -Ascertain
assessment conditions and requirements
Which of the following is NOT a function of the CMMC Accreditation Body (AB)? - correct answer -
Perform assessments or consulting to Organizations Seeking Certification (OSC)
Which of the following is required to become a CMMC Certified Instructor who teaches CMMC
Certified Assessor (CCA) courses? - correct answer -DoD Tier 3 background check
What is the FIRST action you should take if you witness a Code of Professional Conduct (COPC)
violation? - correct answer -Privately request clarification or offer help to the violator
According to the CMMC AB, which of the following should you NOT do when using methods properly?
- correct answer -Make assertions about exam outcomes or assessments
Other than safeguarding CDI, which of the following is NOT a requirement of DFARS 252.204-7012? -
correct answer -Submit a compliance score to the SPRS
With respect to FEDRAMP, what does CIS stand for? - correct answer -Control Implementation
Summary (CIS)
Which of the following is a CORRECT definition of Controlled Unclassified Information (CUI)? - correct
answer -Information that the Government creates or possesses, or that an entity creates or possesses
for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or
permits an agency to handle using safeguarding or dissemination controls.
What part of Title 32 CFR provides context for safeguarding CUI? - correct answer -2002
Which of the following is NOT an appendix to the CMMC Model Overview? - correct answer -Glossary
Which of the following control framework is NOT included in the CMMC Model's Appendix B - Source
Mapping? - correct answer -PCI DSS
, What prompted the creation of the CUI program? - correct answer -Executive Order 13556
Which resource/ruling provides and defines the basic 15 controls that make up the 17 CMMC Level 1
practices? - correct answer -FAR 52.204-21
What function does DODI 5200.48 and Part 2002 of Title 32 CFR serve? - correct answer -Provides
contractors and authorized holders responsibilities in handling CUI
What is a government authority for identifying and marking CUI? - correct answer -National Archives
and Records Administration (NARA)
Which of the following is a type of CUI? - correct answer -Basic
When analyzing CMMC practices, which of the following is an acceptable way to mark the status of an
assessment objective? - correct answer -Not-applicable
During the pre-assessment phase, where is pre-assessment information uploaded to by the CMMC
Quality Assurance Professional (CQAP)? - correct answer -eMASS
Using the DOD Assessment Methodology (DODAM), how many points are deducted for security
requirements that could lead to significant exploitation of the network, or exfiltration of DoD CUI that
are not met? - correct answer -5
How many practices must be met to move the OSC to the POA&M Close-Out Assessment option? -
correct answer -88
The Assessment package must be submitted to the CQAP NLT __ Business Days from the Final Findings
Briefing and uploaded to eMASS NLT __ Business Days from the Final Findings Briefing. - correct
answer -10, 20
During the planning phase of an assessment, you have finished organizing and preparing assessment
documents and templates. Which of the following would be the next step? - correct answer -Ascertain
assessment conditions and requirements
