CMMC Certified CMMC Professional

What does the acronym "OSC" stand for in the CMMC ecosystem?

• AOrganization Seeking Certification
• BOffice of Security Compliance
• COperational Security Coordinator
• DOrganizational Security Council

Which organization is responsible for accrediting C3PAOs under CMMC 2.0 as of 2025?

• ACyber AB (CMMC Accreditation Body)
• BDoD Office of the CIO
• CNational Institute of Standards and Technology (NIST)
• DDefense Counterintelligence and Security Agency (DCSA)

What is the primary purpose of the CMMC program?

• ATo increase defense contractor profits
• BTo protect Federal Contract Information (FCI) and Controlled Unclassified Information (CU…
• CTo replace all existing cybersecurity regulations
• DTo mandate specific commercial software products

A CCP discovers that their spouse works for a company they are assigned to assess. What is the appropriate action?

• AProceed with the assessment but remain extra vigilant
• BDisclose the conflict of interest and recuse themselves from the assessment
• CComplete the assessment quickly to minimize exposure
• DAsk the spouse to take leave during the assessment period

Which of the following is a core principle of the CMMC-AB Code of Professional Conduct?

• AMaximize revenue from assessment activities
• BMaintain confidentiality of sensitive assessment information
• CComplete assessments as quickly as possible
• DShare assessment findings with industry peers

How many maturity levels are defined in CMMC 2.0?

• AThree
• BFive
• CFour
• DSix

Which CMMC 2.0 level requires compliance with NIST SP 800-171 controls?

• ALevel 1 only
• BLevel 2 only
• CLevel 2 and Level 3
• DLevel 1, 2, and 3

What type of information does FCI (Federal Contract Information) represent?

• ATop Secret military information
• BInformation provided by or generated for the government under contract
• CPublicly available government data
• DClassified intelligence information

How many domains are included in the CMMC model?

• A10
• B12
• C14
• D17

In CMMC Level 1, how many practices are required?

• A17
• B55
• C110
• D130

Which NIST publication serves as the basis for CMMC Level 3 requirements?

• ANIST SP 800-53
• BNIST SP 800-171
• CNIST SP 800-172
• DNIST SP 800-30

What is the primary difference between FCI and CUI?

• AFCI is classified; CUI is unclassified
• BFCI requires no protection; CUI requires maximum protection
• CFCI is basic contract information; CUI requires safeguarding or dissemination controls
• DFCI is for commercial contracts; CUI is for defense contracts only

Which domain focuses on limiting information system access to authorized users?

• AIncident Response (IR)
• BAccess Control (AC)
• CMedia Protection (MP)
• DRisk Management (RM)

Which CMMC domain includes practices related to security awareness training?

• APersonnel Security (PS)
• BAwareness and Training (AT)
• CSystem and Information Integrity (SI)
• DConfiguration Management (CM)

A contractor handles CUI but the CUI is only processed in a segregated enclave that does not touch the corporate network. Which statement is correct?

• AThe entire corporate network must meet Level 2 requirements
• BOnly the segregated enclave needs to meet Level 2 requirements
• CThe contractor does not need CMMC certification
• DBasic Level 1 is sufficient for all systems

What does the Audit and Accountability (AU) domain primarily address?

• AFinancial audits of the organization
• BCreating and retaining system audit records
• CExternal compliance audits only
• DEmployee performance reviews

Which domain includes practices for identifying system flaws and reporting system flaws?

• ASystem and Information Integrity (SI)
• BIncident Response (IR)
• CSecurity Assessment (CA)
• DRisk Management (RM)

Which capability requires implementing subnetworks for publicly accessible system components?

• AAC.L1-3.1.1 - Authorized Access Control
• BSC.L1-3.13.1 - Boundary Protection
• CSC.L1-3.13.5 - Boundary Protection
• DAC.L1-3.1.20 - External Connections

What is the first phase of the CMMC assessment process?

• AOn-site assessment
• BPre-assessment or planning phase
• CEvidence collection
• DReport generation

What is a Plan of Action and Milestones (POA&M) used for in CMMC assessments?

• ATo document completed assessment activities
• BTo track remediation of identified deficiencies
• CTo approve contractor budget requests
• DTo schedule employee training

Which type of evidence would an assessor review to verify a practice is implemented?

• AEmployee social media posts
• BPolicies, procedures, and system configurations
• CCompany stock prices
• DCustomer satisfaction surveys

What does eMASS stand for in the context of CMMC?

• AEnterprise Mission Assurance Support Service
• BElectronic Management Assessment Security System
• CEnterprise Monitoring and Security Service
• DElectronic Mission Authorization Support System

During an assessment, an assessor finds that a required practice is not implemented. What finding type should be recorded?

• AStrength
• BDeficiency
• CObservation
• DRecommendation

Which assessment method involves directly observing or testing a security control in operation?

• AExamine
• BInterview
• CTest
• DDocument Review

What is the purpose of the assessment closeout phase?

• ATo schedule the next annual assessment
• BTo finalize findings, develop the report, and provide feedback to the OSC
• CTo hire new assessors
• DTo terminate the contract relationship

Which document provides detailed information about the systems, networks, and security controls in scope for assessment?

• AIncome statement
• BSystem Security Plan (SSP)
• CEmployee handbook
• DMarketing brochure

An organization has deficiencies that cannot be fully remediated before the assessment ends. What must they do to still achieve certification?

• AThe organization cannot achieve certification with any deficiencies
• BDevelop and commit to a POA&M with acceptable timelines for remediation
• CRequest an extension of the assessment period
• DChange their CMMC level requirement

What is the primary purpose of assessment interviews?

• ATo socialize with organization staff
• BTo gather information about how security practices are implemented and followed
• CTo recruit new assessors
• DTo sell additional consulting services

Which of the following best describes the "Examine" assessment method?

• AAsking questions of personnel
• BReviewing policies, procedures, and artifacts
• CPerforming penetration tests
• DObserving network traffic

In a CMMC Level 2 assessment, if a practice is not implemented for all applicable assets, how should this be assessed?

• AIt is fully met if implemented on at least one asset
• BIt is not met if not implemented on all applicable assets
• CIt is partially met requiring a risk acceptance
• DIt is waived for small businesses

Who is responsible for creating the assessment plan?

• AThe Organization Seeking Certification
• BThe Certified Assessor or C3PAO
• CThe Department of Defense
• DThe Cyber AB

What is the validity period of a CMMC certification?

• AOne year
• BTwo years
• CThree years
• DFive years

Which of the following is NOT a typical activity during the on-site assessment phase?

• AReviewing system configurations
• BConducting interviews with personnel
• CDrafting marketing materials
• DObserving security control implementations

An assessor discovers that a security practice was implemented but has been broken for 6 months without detection. How should this be assessed?

• AMet, because the practice was designed correctly
• BNot Met, because the practice is not currently functioning
• CPartially Met with a low-risk rating
• DWaived due to the lack of detection

What is the purpose of the "assessment objective" in the CMMC assessment process?

• ATo set sales targets for the C3PAO
• BTo define what must be verified for a practice to be satisfied
• CTo determine employee salary increases
• DTo establish vacation schedules

Which type of assessment finding indicates a security practice that exceeds requirements?

• ADeficiency
• BStrength
• CObservation
• DRisk

During an assessment, the assessor finds that an organization has outsourced a function that handles CUI to a third party. What must the assessor verify?

• AThat the third party has an equivalent CMMC certification
• BThat the outsourcing contract exists
• CThat the organization has documented the data flow and the third party's security require…
• DThat the third party is located in the United States