CMMC CCP Practice Exam Questions
Study online at https://quizlet.com/_ek2hct
1.What is a CUI Asset?: Asset that stores, processes, or
transmits CUI Examples: Servers, Printers, Endpoints, Cloud
Services, ERP Systems
2.Where do you document a CUI Asset?: Document in Asset
Inventory Document in SSP
Document in Network Diagram
3.What practices do you apply to a CUI Asset?: CMMC Level 2
4.What does CMMC stand for?: Cybersecurity Maturity Model Certification
5.How many controls are in CMMC L2?: 110 controls
6.What impact level is required when storing CUI?: IL4
7.What contract clause is used for CMMC L1?: FAR 52.204-21 (17
practices in total)
8.If you want to be CMMC L2 compliant, do you need to also be CMMC
L1 compliant?: Yes
9.What do you call the part before the first period in the following
control? AC.L1-3.1.1: Domain
10.What do you call the part after the first period in the following
control? AC.L1-3.1.1: Level
11.What do you call the part after the dash in the following
control? AC.L1-3.1.1: Security Practice Number
12.What is confidentiality?: Information Access and disclosure includes
means for protecting personal privacy and proprietary information.
13.What is file integrity?: Stored information is sufficiently guarded
against mod- ification or destruction.
14.What are the three levels of FedRAMP?:
Low Moderate
High
15.What is reciprocity?: Privileges granted by one organization to
another for mutual benefit.
16.What is an Assessment Objective?: Identify the specific items being
assessed and can include specifications, mechanism, activities, and
individuals to receive MET for the practice as defined in NIST SP 800-
171A
Means to gain detailed insight about practices implemented in and by th
OSC and how those practices are performed
17.What are the six components of a CMMC practice?: 1. Identifier and
Practice Statement
2.Assessment Objectives
, CMMC CCP Practice Exam Questions
Study online at https://quizlet.com/_ek2hct
3.Potential Assessment Methods and Objects
4. Discussion
, CMMC CCP Practice Exam Questions
Study online at https://quizlet.com/_ek2hct
5.Further Discussion
6.Key References
18.What is an Assessment Procedure?: Consists of an Assessment
Objective and a set of potential assessment methods
19.What is an Assessment Method?: *Examine
*Interview
*Test
The nature and extent of the Assessors action
20.What are the three characteristics of FCI?: 1. Not intended for public
release
2.It is provided by or for the government
3.It is not transactional bidding information or publicly released
information
21.Is all CUI considered FCI?: Yes
22.What is a Specialized Asset (SA)?: May or may not have CUI -
specialized equipment that can't be updated
Example: Government Property, Operational Tech, Test Equipment, CNC
Machine
23.What three places do you need to document an SA?: Document in
Asset Inventory
Document in SSP
Document in Network Diagram
24.What is a specialized asset assessed against in L2?: Assessed
against CA.L2-3.12.4 (The SSP)
25.What is a Security Protection Asset (SPA) for CUI?: Assets that
provide security functions or capabilities to the contractor's CMMC
Assessment Scope
Support CMMC Compliance state
Examples - SIEM, EndPoint Protection Tools, Protect Assets that have CU
Enter- prise Admin, MSP
26.What is it called when a portion of the company infrastructure is
, CMMC CCP Practice Exam Questions
Study online at https://quizlet.com/_ek2hct
separate from the rest of the company?: Enclaving (Host unit)
27.Where does an OSC register to be issued a UEI and CAGE code?:
SAM.gov
28.What three places do you need to document a SPA?: Document in
Asset Inventory
Study online at https://quizlet.com/_ek2hct
1.What is a CUI Asset?: Asset that stores, processes, or
transmits CUI Examples: Servers, Printers, Endpoints, Cloud
Services, ERP Systems
2.Where do you document a CUI Asset?: Document in Asset
Inventory Document in SSP
Document in Network Diagram
3.What practices do you apply to a CUI Asset?: CMMC Level 2
4.What does CMMC stand for?: Cybersecurity Maturity Model Certification
5.How many controls are in CMMC L2?: 110 controls
6.What impact level is required when storing CUI?: IL4
7.What contract clause is used for CMMC L1?: FAR 52.204-21 (17
practices in total)
8.If you want to be CMMC L2 compliant, do you need to also be CMMC
L1 compliant?: Yes
9.What do you call the part before the first period in the following
control? AC.L1-3.1.1: Domain
10.What do you call the part after the first period in the following
control? AC.L1-3.1.1: Level
11.What do you call the part after the dash in the following
control? AC.L1-3.1.1: Security Practice Number
12.What is confidentiality?: Information Access and disclosure includes
means for protecting personal privacy and proprietary information.
13.What is file integrity?: Stored information is sufficiently guarded
against mod- ification or destruction.
14.What are the three levels of FedRAMP?:
Low Moderate
High
15.What is reciprocity?: Privileges granted by one organization to
another for mutual benefit.
16.What is an Assessment Objective?: Identify the specific items being
assessed and can include specifications, mechanism, activities, and
individuals to receive MET for the practice as defined in NIST SP 800-
171A
Means to gain detailed insight about practices implemented in and by th
OSC and how those practices are performed
17.What are the six components of a CMMC practice?: 1. Identifier and
Practice Statement
2.Assessment Objectives
, CMMC CCP Practice Exam Questions
Study online at https://quizlet.com/_ek2hct
3.Potential Assessment Methods and Objects
4. Discussion
, CMMC CCP Practice Exam Questions
Study online at https://quizlet.com/_ek2hct
5.Further Discussion
6.Key References
18.What is an Assessment Procedure?: Consists of an Assessment
Objective and a set of potential assessment methods
19.What is an Assessment Method?: *Examine
*Interview
*Test
The nature and extent of the Assessors action
20.What are the three characteristics of FCI?: 1. Not intended for public
release
2.It is provided by or for the government
3.It is not transactional bidding information or publicly released
information
21.Is all CUI considered FCI?: Yes
22.What is a Specialized Asset (SA)?: May or may not have CUI -
specialized equipment that can't be updated
Example: Government Property, Operational Tech, Test Equipment, CNC
Machine
23.What three places do you need to document an SA?: Document in
Asset Inventory
Document in SSP
Document in Network Diagram
24.What is a specialized asset assessed against in L2?: Assessed
against CA.L2-3.12.4 (The SSP)
25.What is a Security Protection Asset (SPA) for CUI?: Assets that
provide security functions or capabilities to the contractor's CMMC
Assessment Scope
Support CMMC Compliance state
Examples - SIEM, EndPoint Protection Tools, Protect Assets that have CU
Enter- prise Admin, MSP
26.What is it called when a portion of the company infrastructure is
, CMMC CCP Practice Exam Questions
Study online at https://quizlet.com/_ek2hct
separate from the rest of the company?: Enclaving (Host unit)
27.Where does an OSC register to be issued a UEI and CAGE code?:
SAM.gov
28.What three places do you need to document a SPA?: Document in
Asset Inventory
