CMMC Certified Instructor (CCI) Feed

Question

Which organization was authorized as the CMMC Assessor and Instructor Certification Organization (CAICO) effective December 2025, replacing Cyber AB in that role?

Cmmc Ecosystem And Roles

Question · Easy

Question

What is the primary role of an Organization Seeking Certification (OSC) within the CMMC ecosystem?

Cmmc Ecosystem And Roles

Question · Easy

Question

A Certified CMMC Instructor (CCI) who holds only a valid CCP credential is authorized to instruct which candidates?

Cmmc Ecosystem And Roles

Question · Medium

Podcast

Tech Exam Prep Podcast

Listen on Spotify

Podcast

Question

Which CMMC ecosystem actor is authorized to conduct Level 2 third-party certification assessments of OSCs?

Cmmc Ecosystem And Roles

Question · Easy

Question

How many levels does the CMMC 2.0 model contain, and what is each level's primary focus?

Cmmc Model Domains And Practices

Question · Easy

Question

How many security practices does CMMC Level 1 require, and which federal regulation specifies them?

Cmmc Model Domains And Practices

Question · Medium

Question

CMMC Level 2 is built upon which NIST publication and how many security requirements does it encompass?

Nist Sp 800 171 And 800 172

Question · Easy

Question

Which of the following is the correct list of the 14 NIST SP 800-171 control families (domains) that form the basis of CMMC Level 2?

Nist Sp 800 171 And 800 172

Question · Medium

Question

What is the purpose of NIST SP 800-172, and how many of its enhanced requirements are incorporated into CMMC Level 3?

Nist Sp 800 171 And 800 172

Question · Medium

Question

Under 32 CFR Part 170, which entity conducts CMMC Level 3 certification assessments of OSCs?

Assessment Process And Scoping

Question · Medium

Question

An OSC receives a Conditional Level 2 CMMC Status after a C3PAO assessment with some unmet requirements. Within how many days must all POA&M items be closed to avoid losing this status?

Assessment Process And Scoping

Question · Medium

Question

In CMMC scoping for a Level 2 assessment, which asset category is assessed against only those practices relevant to the security capability the asset provides, rather than all 110 requirements?

Assessment Process And Scoping

Question · Hard

Question

What is Federal Contract Information (FCI), and how does it differ from Controlled Unclassified Information (CUI)?

Cui Handling

Question · Easy

Question

Which DFARS clause requires defense contractors to implement NIST SP 800-171, use a FedRAMP Moderate-equivalent cloud service provider, and report cyber incidents to the DoD within 72 hours?

Cui Handling

Question · Medium

Question

The CUI Registry, managed by the National Archives and Records Administration (NARA), serves what function in the CMMC ecosystem?

Cui Handling

Question · Medium

Question

Which principle of the CMMC Code of Professional Conduct requires practitioners to protect customer sensitive data, trade secrets, and business strategies learned during CMMC service delivery?

Cmmc Code Of Professional Conduct

Question · Easy

Question

Under the CMMC Code of Professional Conduct, if a CCI becomes aware that another CMMC professional has violated the CoPC, what are they required to do?

Cmmc Code Of Professional Conduct

Question · Medium

Question

The Impartiality principle of the CMMC Code of Professional Conduct primarily requires CMMC professionals to do which of the following?

Cmmc Code Of Professional Conduct

Question · Easy

Question

A Registered Practitioner (RP) working for an RPO is advising an OSC on CMMC readiness. Which activity is an RP explicitly NOT authorized to perform?

Cmmc Ecosystem And Roles

Question · Medium

Question

An OSC seeking CMMC Level 3 certification must first achieve which prerequisite status?

Assessment Process And Scoping

Question · Hard

Question

What does the SPRS score represent in the CMMC compliance context, and what is the maximum possible score?

Assessment Process And Scoping

Question · Medium

Question

Adult learning theory (andragogy) differs from pedagogy primarily in which way relevant to CCI instructional delivery?

Instructional Delivery And Adult Learning

Question · Easy

Question

A CCI is designing a half-day CMMC CCP preparation session for a cohort of experienced security engineers. Which instructional approach best aligns with adult learning principles?

Instructional Delivery And Adult Learning

Question · Medium

Question

CMMC instructor certifications (CCI) are valid for how long, and what is required to maintain certification?

Cmmc Ecosystem And Roles

Question · Easy

Question

The NIST SP 800-171 Access Control (3.1) family requires organizations to do which of the following as a baseline practice?

Nist Sp 800 171 And 800 172

Question · Medium

Question

Which NIST SP 800-171 control family requires organizations to provide security awareness training to all users and ensure that personnel understand the security risks associated with their activities?

Nist Sp 800 171 And 800 172

Question · Easy

Question

Within NIST SP 800-171, which control family (domain) requires organizations to establish and maintain baseline configurations and inventories of organizational systems, and restrict the use of unauthorized software?

Nist Sp 800 171 And 800 172

Question · Medium

Question

NIST SP 800-171 requirement 3.3.1 requires organizations to create and retain system audit logs to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized activity. Which control family does this fall under?

Nist Sp 800 171 And 800 172

Question · Medium

Question

A CMMC instructor is teaching the Identification and Authentication (IA) domain. Which of the following practices is a core IA requirement in NIST SP 800-171?

Nist Sp 800 171 And 800 172

Question · Medium

Question

In a CMMC Level 2 assessment, which document serves as the primary artifact demonstrating how an OSC has implemented the 110 NIST SP 800-171 security requirements across its environment?

Assessment Process And Scoping

Question · Easy

Question

When conducting a CMMC assessment, assessors use three primary assessment methods to gather evidence. Which of the following correctly identifies these three methods?

Assessment Process And Scoping

Question · Medium

Question

What is the primary distinction between a Registered Practitioner (RP) and a Certified CMMC Professional (CCP) in the CMMC ecosystem?

Cmmc Ecosystem And Roles

Question · Medium

Question

Which NIST SP 800-171 domain requires organizations to protect CUI during storage, transit, and in physical form, including by controlling the use of removable media?

Nist Sp 800 171 And 800 172

Question · Easy

Question

NIST SP 800-171 requirement 3.13.8 requires organizations to implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission. This falls under which control family?

Nist Sp 800 171 And 800 172

Question · Medium

Question

During a CMMC CCI course, a student asks which NIST SP 800-171 control family requires the organization to perform periodic risk assessments and scan for vulnerabilities. What is the correct answer?

Nist Sp 800 171 And 800 172

Question · Easy

Question

CMMC Level 3 adds 24 enhanced requirements from NIST SP 800-172 to protect CUI against APTs. Which of the following best characterizes the types of additional controls included in these Level 3 enhancements?

Nist Sp 800 171 And 800 172

Question · Hard

Question

A CCI is explaining the 'flow-down' requirement in CMMC. What does flow-down mean in the context of a prime contractor's supply chain?

Cmmc Ecosystem And Roles

Question · Medium

Question

In the CMMC scoping process, an asset that cannot process, store, or transmit CUI and does not provide security protections for CUI assets is classified as which type?

Assessment Process And Scoping

Question · Medium

Question

Which NIST SP 800-171 control family requires organizations to limit physical access to organizational systems and equipment to authorized individuals?

Nist Sp 800 171 And 800 172

Question · Easy

Question

A CCI candidate asks: 'What is the System and Information Integrity (SI) domain primarily concerned with?' Which answer is correct?

Nist Sp 800 171 And 800 172

Question · Easy

Question

An OSC subject to CMMC Level 2 must reaffirm in SPRS its compliance annually but conduct a full new assessment how frequently?

Assessment Process And Scoping

Question · Medium

Question

A CUI category marking of 'CUI//SP-CTI' (Specified — Cyber Threat Intelligence) appears on a document. What does the 'SP' designation indicate?

Cui Handling

Question · Hard

Question

During a CMMC training session, a student asks what happens if an OSC discovers a cyber incident affecting CUI after achieving CMMC Level 2 certification. What is the correct response regarding reporting obligations?

Cui Handling

Question · Medium

Question

What does the Professionalism principle in the CMMC Code of Professional Conduct specifically require of all credentialed professionals?

Cmmc Code Of Professional Conduct

Question · Easy

Question

A CCI is teaching the Incident Response (IR) domain of NIST SP 800-171. Which of the following is a core requirement in this domain?

Nist Sp 800 171 And 800 172

Question · Medium

Question

Which assessment finding status indicates that all elements of a NIST SP 800-171 requirement have been verified as fully implemented in the OSC's environment?

Assessment Process And Scoping

Question · Easy

Question

A defense subcontractor only handles Federal Contract Information (FCI) and has no CUI. Which CMMC level is required, and what assessment type must it complete?

Cmmc Model Domains And Practices

Question · Medium

Loading more…