CMMC CCP Practice Exam Questions
Question 1.
What is a CUI Asset?
ANSWER
Asset that stores, processes, or transmits CUI Examples: Servers, Printers, Endpoints, Cloud Services, ERP Systems
Question 2.
Where do you document a CUI Asset?
ANSWER
Document in Asset Inventory Document in SSP Document in Network Diagram
Question 3.
What practices do you apply to a CUI Asset?
ANSWER
CMMC Level 2
Question 4.
What does CMMC stand for?
ANSWER
Cybersecurity Maturity Model Certification
Question 5.
How many controls are in CMMC L2?
ANSWER
110 controls
Question 6.
What impact level is required when storing CUI?
ANSWER
IL4
Question 7.
What contract clause is used for CMMC L1?
ANSWER
FAR 52.204-21 (17 practices in total)
, Question 8.
If you want to be CMMC L2 compliant, do you need to also be CMMC L1 compliant?
ANSWER
Yes
Question 9.
What do you call the part before the first period in the following control? AC.L1-3.1.1
ANSWER
Domain
Question 10.
What do you call the part after the first period in the following control? AC.L1-3.1.1
ANSWER
Level
Question 11.
What do you call the part after the dash in the following control? AC.L1-3.1.1
ANSWER
Security Practice Number
Question 12.
What is confidentiality?
ANSWER
Information Access and disclosure includes means for protecting personal privacy and proprietary information.
Question 13.
What is file integrity?
ANSWER
Stored information is sufficiently guarded against modification or destruction.
Question 14.
What are the three levels of FedRAMP?
ANSWER
Low Moderate High
Question 15.
What is reciprocity?
ANSWER
Privileges granted by one organization to another for mutual benefit.
, Question 16.
What is an Assessment Objective?
ANSWER
Identify the specific items being assessed and can include specifications, mechanism, activities, and individuals to receive MET for the practice as defined in
NIST SP 800-171A Means to gain detailed insight about practices implemented in and by the OSC and how those practices are performed
Question 17.
What are the six components of a CMMC practice?
ANSWER
1. Identifier and Practice Statement
2. Assessment Objectives
3. Potential Assessment Methods and Objects
4. Discussion
5. Further Discussion
6. Key References
Question 18.
What is an Assessment Procedure?
ANSWER
Consists of an Assessment Objective and a set of potential assessment methods
Question 19.
What is an Assessment Method?
ANSWER
*Examine *Interview *Test The nature and extent of the Assessors action
Question 20.
What are the three characteristics of FCI?
ANSWER
1. Not intended for public release
2. It is provided by or for the government
3. It is not transactional bidding information or publicly released information
Question 21.
Is all CUI considered FCI?
ANSWER
Yes
Question 22.
What is a Specialized Asset (SA)?
ANSWER
May or may not have CUI - specialized equipment that can't be updated Example: Government Property, Operational Tech, Test Equipment, CNC Machine
Question 1.
What is a CUI Asset?
ANSWER
Asset that stores, processes, or transmits CUI Examples: Servers, Printers, Endpoints, Cloud Services, ERP Systems
Question 2.
Where do you document a CUI Asset?
ANSWER
Document in Asset Inventory Document in SSP Document in Network Diagram
Question 3.
What practices do you apply to a CUI Asset?
ANSWER
CMMC Level 2
Question 4.
What does CMMC stand for?
ANSWER
Cybersecurity Maturity Model Certification
Question 5.
How many controls are in CMMC L2?
ANSWER
110 controls
Question 6.
What impact level is required when storing CUI?
ANSWER
IL4
Question 7.
What contract clause is used for CMMC L1?
ANSWER
FAR 52.204-21 (17 practices in total)
, Question 8.
If you want to be CMMC L2 compliant, do you need to also be CMMC L1 compliant?
ANSWER
Yes
Question 9.
What do you call the part before the first period in the following control? AC.L1-3.1.1
ANSWER
Domain
Question 10.
What do you call the part after the first period in the following control? AC.L1-3.1.1
ANSWER
Level
Question 11.
What do you call the part after the dash in the following control? AC.L1-3.1.1
ANSWER
Security Practice Number
Question 12.
What is confidentiality?
ANSWER
Information Access and disclosure includes means for protecting personal privacy and proprietary information.
Question 13.
What is file integrity?
ANSWER
Stored information is sufficiently guarded against modification or destruction.
Question 14.
What are the three levels of FedRAMP?
ANSWER
Low Moderate High
Question 15.
What is reciprocity?
ANSWER
Privileges granted by one organization to another for mutual benefit.
, Question 16.
What is an Assessment Objective?
ANSWER
Identify the specific items being assessed and can include specifications, mechanism, activities, and individuals to receive MET for the practice as defined in
NIST SP 800-171A Means to gain detailed insight about practices implemented in and by the OSC and how those practices are performed
Question 17.
What are the six components of a CMMC practice?
ANSWER
1. Identifier and Practice Statement
2. Assessment Objectives
3. Potential Assessment Methods and Objects
4. Discussion
5. Further Discussion
6. Key References
Question 18.
What is an Assessment Procedure?
ANSWER
Consists of an Assessment Objective and a set of potential assessment methods
Question 19.
What is an Assessment Method?
ANSWER
*Examine *Interview *Test The nature and extent of the Assessors action
Question 20.
What are the three characteristics of FCI?
ANSWER
1. Not intended for public release
2. It is provided by or for the government
3. It is not transactional bidding information or publicly released information
Question 21.
Is all CUI considered FCI?
ANSWER
Yes
Question 22.
What is a Specialized Asset (SA)?
ANSWER
May or may not have CUI - specialized equipment that can't be updated Example: Government Property, Operational Tech, Test Equipment, CNC Machine
