CMMC-CCP Practice Questions

The Cybersecurity Maturity Model Certification (CMMC) framework is structured in three levels. Level 2 (Advanced) is the minimum certification level required for contractors who handle Controlled Unclassified Information (CUI). This level's requirements are directly aligned with the 110 security controls specified in NIST SP 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." Level 1 is designed only for protecting Federal Contract Information (FCI), which has less stringent safeguarding requirements than CUI. Therefore, to be awarded a contract involving CUI, an organization must demonstrate compliance with at least Level 2.

A. Level 1: This level is for the protection of Federal Contract Information (FCI) only and does not meet the requirements for safeguarding CUI.

C. Level 3: While a Level 3 certified contractor can handle CUI, it is not the minimum required level. Level 3 includes enhanced controls against Advanced Persistent Threats (APTs).

D. Any level: This is incorrect because Level 1 is insufficient for handling CUI, which requires the specific controls found starting at Level 2.

1. U.S. Department of Defense (DoD). (2021

November). Cybersecurity Maturity Model Certification (CMMC) Model Overview

Version 2.0.

Page 3

Table 1 "CMMC Model Structure": This table explicitly states the focus of Level 1 is "FCI" and the focus of Level 2 is "CUI". It also notes that Level 2 requirements are aligned with NIST SP 800-171.

2. National Institute of Standards and Technology (NIST). (2020

February). Special Publication (SP) 800-171 Rev. 2: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Section 1.1

Page 1

Paragraph 2: "The requirements apply to all CUI... on nonfederal systems." This document forms the basis of CMMC Level 2

establishing it as the standard for CUI protection.

3. Georgia Tech Research Institute (GTRI). (2022). CMMC 2.0: What It Is and How to Prepare.

Section "CMMC 2.0 Levels"

Page 2: "Level 2 (Advanced) is for companies that work with Controlled Unclassified Information (CUI)... This level is comparable to the old CMMC Level 3 and mirrors NIST SP 800-171." This university-affiliated research institute publication confirms Level 2 as the requirement for CUI.

The Cyber AB Code of Professional Conduct (CoPC) outlines several core tenets that certified professionals must adhere to. The tenet of "Professionalism" is explicitly defined as the requirement to "Refrain from any and all forms of dishonesty in all dealings regarding CMMC." This principle establishes a foundation of integrity, truthfulness, and ethical behavior, which is paramount for maintaining the credibility of the CMMC ecosystem and the professionals who operate within it.

A. Do not copy materials without permission to do so. This statement describes the CoPC tenet of "Proper Use of Materials," not "Professionalism."

B. Do not make assertions about assessment outcomes. This statement describes the CoPC tenet of "Objectivity," which focuses on impartiality and avoiding conflicts of interest.

D. Ensure the security of all information discovered or received. This statement describes the CoPC tenet of "Confidentiality," which governs the protection of sensitive information.

1. The Cyber AB. (2022

October 25). Cyber AB Code of Professional Conduct

Version 1.2.

Section 3.1

Professionalism

Page 3: "Refrain from any and all forms of dishonesty in all dealings regarding CMMC."

Section 3.2

Objectivity

Page 3: "Refrain from making assertions about assessment outcomes..."

Section 3.3

Confidentiality

Page 3: "Ensure the security of all information discovered or received..."

Section 3.4

Proper Use of Materials

Page 3: "Do not copy or otherwise use materials without permission to do so."

In the context of the CMMC Assessment Process, a "Supporting Organization/Unit" refers to an external entity that provides people, processes, or technology to the Organization Seeking Certification (OSC). These supporting elements are included within the assessment scope because they handle, process, or protect Controlled Unclassified Information (CUI) on behalf of the OSC. However, the supporting organization itself does not receive a CMMC certification from the OSC's assessment. Its compliance is evaluated solely in relation to the services it provides to the OSC. This is a common scenario with External Service Providers (ESPs) like cloud vendors or managed service providers.

A. Host Unit: This is not a defined term within the CMMC framework or its associated assessment process documentation.

B. Organization: This term is too general. The question asks for the specific term describing an external entity that supports the primary organization being assessed.

C. Coordinating Unit: This is not an official CMMC term used to describe an external entity that is part of the assessment scope.

1. U.S. Department of Defense (DoD)

CMMC Level 2 Scoping Guide

Version 2.0

December 2

2022.

Section 3.3

"External Service Provider (ESP) Considerations" (Page 10): This section details how external organizations that provide services to the OSC are handled within the assessment scope. It states

"The OSC is responsible for CUI protection when leveraging external services... The C3PAO assesses the OSC’s implementation of CMMC practices that apply to the services provided by the ESP." This describes the function of a "Supporting Organization/Unit."

2. U.S. Department of Defense (DoD)

CMMC Assessment Process (CAP) for CMMC Level 2

Version 2.0

December 2

2022.

Section 2.2

"Assessment Planning" (Page 13): This section outlines the planning activities

which include defining the assessment scope. The identification of all external dependencies and supporting entities that handle CUI is a critical part of this phase

reinforcing the concept of evaluating supporting organizations as part of the OSC's assessment.

NIST Special Publication 800-88 Revision 1, "Guidelines for Media Sanitation," explicitly defines three categories of sanitization to counter data remanence. These categories are Clear, Purge, and Destroy. 'Clear' involves using logical techniques to sanitize data against simple recovery tools. 'Purge' uses physical or logical techniques to make data recovery infeasible even with advanced laboratory methods. 'Destroy' renders the media completely unusable and unable to store data again, making data recovery impossible. These three terms form the foundational framework for media sanitization decisions within the standard.

B. "Redact" is a term for obscuring or removing sections of a document, not a category for sanitizing entire storage media as defined by NIST.

C. "Overwrite" is a specific method used to perform the 'Clear' action; it is not one of the three primary categories of sanitization.

D. Similar to option C, "overwrite" is a technique or method, not a distinct top-level category alongside 'Clear' and 'Destroy' in the NIST framework.

1. National Institute of Standards and Technology (NIST). (December 2014). SP 800-88 Rev. 1

Guidelines for Media Sanitation. U.S. Department of Commerce.

Executive Summary

Page vii

Paragraph 2: "The types of sanitization are Clear

Purge

and Destroy."

Section 2.3

Page 8: This section is titled "Sanitization and Disposition Decisions" and provides detailed definitions for Clear

Purge

and Destroy.

2. Carnegie Mellon University

Information Security Office. (n.d.). Guidelines for Data Sanitization and Disposal.

Section: Sanitization Methods: This document directly references and defines the three methods from NIST SP 800-88 Rev. 1: "The following methods are based on the NIST 800-88 Guidelines for Media Sanitation: Clear

Purge

Destroy."

The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting," directly addresses the security requirements for external cloud service providers (CSPs). Paragraph (b)(2)(ii)(D) of this clause mandates that if a contractor uses an external CSP to store, process, or transmit Covered Defense Information (CDI), which includes CUI, the contractor must ensure the CSP meets security requirements equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. This ensures a consistent and adequate level of protection for sensitive defense information hosted in the cloud.

A. FedRAMP Low: This impact level is insufficient for protecting CDI/CUI as DFARS 252.204-7012 explicitly specifies the Moderate baseline as the minimum requirement.

C. FedRAMP High: While a provider at this level would be compliant, it is not the minimum requirement established by the clause; FedRAMP Moderate is the specified baseline.

D. FedRAMP Secure: "FedRAMP Secure" is not an official impact level designation within the FedRAMP program. The established baselines are Low, Moderate, and High.

1. Defense Federal Acquisition Regulation Supplement (DFARS)

Clause 252.204-7012

Safeguarding Covered Defense Information and Cyber Incident Reporting (DEC 2019). Paragraph (b)(2)(ii)(D) states: "...the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline..."

2. U.S. Department of Defense

Chief Information Officer. "Frequently Asked Questions (FAQs) regarding DFARS Clause 252.204-7012 and NIST SP 800-171

" Version 1.1

January 27

2020. Question 49 directly confirms: "The security requirement for a cloud computing service is the FedRAMP Moderate baseline."

3. General Services Administration (GSA). "About FedRAMP." FedRAMP.gov. The official website outlines the program's structure and defines the security baselines as Low

Moderate

and High

confirming that "FedRAMP Secure" is not a valid designation. (Accessed via https://www.fedramp.gov/about-us/)

The definition provided in the question is the official definition of "Cybersecurity" used by the U.S. Government, including the Department of Defense (DoD). It precisely describes the protection of digital assets ("computers and electronic communications systems") and the data they contain. This definition is comprehensive, covering not only the classic Confidentiality, Integrity, and Availability (CIA) triad but also the crucial aspects of Authentication and Nonrepudiation, which are fundamental to modern digital security practices and are explicitly called out in the CMMC framework's underlying standards.

B. Data security: This term is too narrow, as it focuses specifically on protecting data itself, rather than the broader "computers and electronic communications systems/services" mentioned in the question.

C. Network security: This is a subset of cybersecurity focused on protecting the underlying network infrastructure from unauthorized access and misuse, not the entire scope of systems and information.

D. Information security: While closely related, this is a broader term that encompasses the protection of information in all forms (digital, physical, etc.), whereas cybersecurity specifically pertains to the electronic or "cyber" domain.

1. National Institute of Standards and Technology (NIST). (2020). NISTIR 7298 Revision 3: Glossary of Key Information Security Terms.

Page 61: Provides the verbatim definition for Cybersecurity: "Prevention of damage to

protection of

and restoration of computers

electronic communications systems

electronic communications services

wire communication

and electronic communication

including information contained therein

to ensure its availability

integrity

authentication

confidentiality

and nonrepudiation." This document notes the definition is derived from CNSSI 4009.

DOI: https://doi.org/10.6028/NIST.IR.7298r3

2. Committee on National Security Systems. (2015). CNSSI 4009: Committee on National Security Systems (CNSS) Glossary.

Page 23: This is the original source document for the official U.S. Government definition of Cybersecurity

which is identical to the one presented in the question and adopted by NIST and the DoD.

3. U.S. Department of Defense. (2022). CMMC 2.0 Program.

The CMMC program is fundamentally a cybersecurity initiative. Its scope

as detailed in the model documentation and scoping guides

directly aligns with protecting systems and information within the cyber domain to ensure attributes like confidentiality and integrity

reflecting the core definition of cybersecurity. The entire framework is an application of this definition.

During Phase 4 (Closeout) of the CMMC assessment, the Lead Assessor, on behalf of the C3PAO, finalizes the assessment results. This involves confirming that the Organization Seeking Certification (OSC) has met all applicable CMMC practices and objectives for the target level. The final recommendation submitted to the C3PAO is a formal attestation of whether the OSC has met the stringent, predefined criteria of the CMMC standard. This determination of meeting all requirements is fundamentally a conclusion on the OSC's eligibility for certification.

A. Ability: This term is too general. The assessment verifies the actual implementation of controls, not just the potential or general ability to be secure.

C. Capability: While the assessment evaluates the OSC's cybersecurity capabilities, the final recommendation is a formal judgment on qualification, which is more precisely termed eligibility.

D. Suitability: This implies a subjective judgment of appropriateness. The CMMC assessment is an objective verification against a standard to determine if the OSC qualifies, making eligibility the correct term.

---

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for CMMC Level 2

Version 2.1

Section 4.4

"Closeout" (p. 16). This section describes the final reporting and recommendation activities. The C3PAO's "certification recommendation" is the direct output

which is predicated on the Lead Assessor's determination that the OSC has met all requirements

thus establishing its eligibility for certification.

2. Cyber AB

CMMC Code of Professional Conduct (CoPC)

Version 2.1

Section 3

"Responsibility to the Profession" (p. 4). This document requires assessors to "Provide diligent and competent services" and "Maintain objectivity." This objective evaluation against the CMMC standard is the process of determining an OSC's eligibility for certification

not its general ability or suitability.

The CMMC Assessment Process (CAP) specifies that an OSC can receive a conditional Level-2 certification with POA&Ms only when the total number of NOT MET practices “does not exceed 10 percent of the practices within scope.”

For Level 2, 110 practices are always in scope; 10 percent equals 11.

Because the OSC failed 15 practices—exceeding this 11-practice ceiling—it is automatically ineligible for the remediation/POA&M option. The correct determination therefore is that no option to remediate is available.

A. 90-day remediation is available only when the OSC is within the POA&M eligibility limit (≤11 NOT MET); 15 exceeds this.

C. Eligibility is not discretionary here; exceeding the 10 % cap makes the OSC definitively ineligible.

D. Assessment cancellation is not mentioned; ineligibility results from too many NOT MET practices, not from cancellation.

1. Cyber AB

“CMMC Assessment Process (CAP) v1.0

” §4.9.1 Eligibility for POA&M

p. 34 (28 Aug 2023) – states POA&Ms allowed only when NOT MET ≤ 10 % of practices.

2. Cyber AB

“CMMC Assessment Process (CAP) v1.0

” Table 4-3

p. 36 – Level 2 universe = 110 practices (hence 10 % = 11).

3. U.S. DoD

“CMMC Program Proposed Rule

” Fed. Reg. 88 FR 88596

§170.22(b)(3)(i) (2023) – mirrors CAP limit: up to 10 % of requirements may be on POA&M for conditional certification.

CMMC Level 1 (Foundational) is focused on the protection of Federal Contract Information (FCI). The 15 security practices required for a Level 1 Self-Assessment are taken directly from the basic safeguarding requirements stipulated in Federal Acquisition Regulation (FAR) clause 52.204-21, "Basic Safeguarding of Covered Contractor Information Systems." This FAR clause is the foundational contractual requirement for all federal contractors to protect FCI on their nonfederal information systems. Therefore, it is the specific clause that requires a contractor to meet these basic safeguarding requirements.

B. 22CFR 120-130: This citation refers to the International Traffic in Arms Regulations (ITAR), which governs the export of defense articles and services, not the general safeguarding of FCI.

C. DFARS 252.204-7011: This Defense Federal Acquisition Regulation Supplement (DFARS) clause, "Alternative Line Item Structure," pertains to how contract line items are organized and is unrelated to cybersecurity.

D. DFARS 252.204-7021: This DFARS clause, "Cybersecurity Maturity Model Certification Requirement," is the mechanism that enforces CMMC assessments within DoD contracts but does not originate the FCI safeguarding requirements themselves.

1. U.S. Department of Defense (DoD). (2021). Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0. Page 4

"CMMC Level 1

Foundational

" states

"CMMC Level 1 is equivalent to all of the safeguarding requirements specified in Federal Acquisition Regulation (FAR) clause 52.204-21."

2. General Services Administration

DoD

NASA. (2016). Federal Acquisition Regulation; Basic Safeguarding of Covered Contractor Information Systems. 48 C.F.R. § 52.204-21. This document is the primary source text for the 15 basic safeguarding requirements for FCI.

3. Johns Hopkins University Applied Physics Laboratory & DoD. (2023). CMMC Assessment Process (CAP) for CMMC Level 1 Version 2.1. Page 1

Section 1.1

"The CMMC Level 1 assessment scope is focused on FCI assets

which are information systems

system components

or assets that process

store

or transmit FCI. The CMMC Level 1 requirements are from FAR 52.204-21."

The CMMC practice AC.L1-3.1.22, "Control information posted or processed on publicly accessible systems," is fundamentally about preventing the unauthorized disclosure of sensitive government information. At CMMC Level 1, the focus is on protecting Federal Contract Information (FCI). A press release is posted on a publicly accessible system (e.g., a company website). Therefore, the most critical factor from a CMMC perspective is to ensure that the information being released has been reviewed and authorized to prevent the spillage of FCI, which is defined as information not intended for public release.

A. Information accuracy is a general business best practice, not the specific focus of this CMMC control, which is concerned with safeguarding FCI.

B. CEO approval is an internal corporate governance process; the CMMC control requires authorization by a designated individual/group, not necessarily the CEO.

D. This statement is the opposite of the requirement. FCI is, by definition, "not intended for public release" and must be protected, not posted.

1. U.S. Department of Defense

Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0

(December 2021). Domain: Access Control (AC)

Practice AC.L1-3.1.22

Page 11. The practice requires control over information on public systems

which directly implies safeguarding FCI.

2. NIST Special Publication 800-171

Revision 2

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

(February 2020). Section 3.1.22

Page 23. The discussion for this control states

"Organizations ensure that FCI is not included on publicly accessible systems."

3. Code of Federal Regulations

48 CFR § 52.204-21

Basic Safeguarding of Covered Contractor Information Systems

(June 2016). Section (a) Definitions. Defines Federal Contract Information (FCI) as "information

not intended for public release

that is provided by or generated for the Government under a contract..."