CMMC Registered Practitioner (RP)

What does the acronym 'RP' stand for in the CMMC ecosystem?

• ARegistered Practitioner
• BRecognized Professional
• CRegulatory Partner
• DReadiness Provider

Which organization serves as the sole official accreditation body for the CMMC ecosystem?

• ANIST
• BDCSA
• CCyber AB
• DISACA

An RP is affiliated with which type of organization in the CMMC ecosystem?

• ARPO
• BOSC
• CDCSA
• DC3PAO

What type of services is a CMMC Registered Practitioner authorized to provide?

• AAdvisory and readiness consulting services to OSCs
• BDoD contract award recommendations
• CFormal CMMC Level 2 assessments
• DCMMC certification decisions

What does 'OSC' stand for in the CMMC ecosystem?

• AOperational Security Contractor
• BOversight and Security Certification
• COffice of Sector Compliance
• DOrganization Seeking Certification

What does 'C3PAO' stand for in the CMMC ecosystem?

• AContractor Cybersecurity Compliance and Procurement Authority Organization
• BCMMC Coordinated Professional Assessment Organization
• CCMMC Certified Compliance and Professional Assessment Office
• DCMMC Third-Party Assessment Organization

Which CMMC ecosystem role conducts formal Level 2 certification assessments?

• ARegistered Practitioner (RP)
• BAuthorized Training Provider (ATP)
• CCertified CMMC Assessor (CCA)
• DRegistered Practitioner Organization (RPO)

How many CMMC maturity levels exist in CMMC 2.0?

• A2
• B4
• C3
• D5

CMMC Level 1 is primarily designed to protect which type of information?

• AFederal Contract Information (FCI)
• BControlled Unclassified Information (CUI)
• CClassified National Security Information
• DPersonally Identifiable Information (PII)

CMMC Level 2 maps its practices to which NIST publication?

• ANIST SP 800-53
• BNIST SP 800-171 Rev. 2
• CNIST SP 800-172
• DNIST SP 800-82

How many practices does CMMC Level 1 require?

• A15
• B48
• C17
• D110

Which of the following is a CMMC Level 1 Access Control practice?

• AEstablish an incident response capability
• BConduct regular security awareness training
• CLimit information system access to authorized users, processes, or devices
• DEncrypt CUI in transit

Which CMMC Level 1 practice requires organizations to verify and control connections to external information systems?

• AAC.L1-b.1.i
• BSI.L1-b.1.xiv
• CSC.L1-b.1.x
• DAC.L1-b.1.iii

Which CMMC Level 1 domain requires organizations to sanitize or destroy information system media before disposal or reuse?

• AAccess Control (AC)
• BSystem & Communications Protection (SC)
• CMedia Protection (MP)
• DPhysical Protection (PE)

Under CMMC Level 1, which practice requires organizations to identify information system users and devices?

• AAC.L1-b.1.i — Limit access to authorized users
• BIA.L1-b.1.v — Identify information system users, processes, and devices
• CPE.L1-b.1.ix — Limit physical access to authorized individuals
• DSC.L1-b.1.x — Monitor and control communications

Which CMMC Level 1 System & Information Integrity practice requires organizations to identify, report, and correct information system flaws?

• ASI.L1-b.1.xiv — Flaw remediation
• BSI.L1-b.1.xv — Malicious code protection
• CSC.L1-b.1.x — Boundary protection
• DAC.L1-b.1.ii — Limit transactions and functions

CMMC Level 1 requires organizations to limit information system access to which of the following?

• AEmployees with at least two years of experience
• BPersonnel who have completed cybersecurity awareness training
• COnly cleared personnel with security clearances
• DAuthorized users, processes acting on behalf of authorized users, or devices

Which Level 1 Physical Protection practice requires limiting physical access to authorized individuals?

• APE.L1-b.1.ix — Limit physical access
• BAC.L1-b.1.iii — Verify external connections
• CPE.L1-b.1.x — Monitor physical access logs
• DMP.L1-b.1.viii — Sanitize media

Under CMMC Level 1, what must organizations do regarding malicious code protection (SI.L1-b.1.xv)?

• AUse only government-approved antivirus tools
• BReport all malware detections to DCSA within 24 hours
• CPerform weekly manual scans only
• DProvide protections from malicious code at appropriate locations

Which of the six Level 1 domains requires organizations to monitor and control communications at external boundaries and key internal boundaries?

• AAccess Control (AC)
• BIdentification & Authentication (IA)
• CSystem & Communications Protection (SC)
• DPhysical Protection (PE)

What is the primary regulatory driver for CMMC Level 1 practices?

• ADFARS 252.204-7012
• BFAR 52.204-21
• CNIST SP 800-171 Rev. 2
• DExecutive Order 14028

FAR 52.204-21 applies to contractors whose covered information systems do which of the following?

• AProcess, store, or transmit FCI
• BOperate on DoD network infrastructure
• CHandle CUI under a DFARS contract
• DStore classified defense secrets only

FAR 52.204-21 flow-down requirements mean that prime contractors must ensure which of the following?

• AThe DoD directly monitors all subcontractors' systems
• BOnly the prime contractor needs to comply; subcontractors are exempt
• CSubcontractors must achieve CMMC Level 2 before receiving any FCI
• DSubcontractors who handle FCI must also comply with FAR 52.204-21

Which FAR 52.204-21 practice requires that organizations control information posted or processed on publicly accessible information systems?

• A(b)(1)(iv) — Control publicly accessible information
• B(b)(1)(i) — Limit access to authorized users
• C(b)(1)(xiii) — Perform periodic scans
• D(b)(1)(x) — Monitor and control communications

Does FAR 52.204-21 apply to contracts for Commercial Off-The-Shelf (COTS) items?

• AYes, COTS contractors must still implement all 15 safeguarding requirements
• BNo, COTS item contracts are explicitly excluded from FAR 52.204-21
• COnly COTS items above $5 million must comply
• DCOTS contractors need only implement access control requirements

What is Federal Contract Information (FCI) as defined by FAR 52.204-21?

• AInformation classified as Secret or Top Secret under executive order
• BInformation provided by or generated for the government under a contract to develop or de…
• CAny data stored on government-owned networks
• DSensitive Personally Identifiable Information collected during contract performance

What is Controlled Unclassified Information (CUI) as defined by the National Archives and Records Administration (NARA)?

• ASensitive but unclassified (SBU) information shared at the contractor's discretion
• BAny contractor-developed intellectual property
• CInformation the government creates or possesses, or that an entity creates or possesses f…
• DInformation classified under Executive Order 13526

Which federal executive order established the Controlled Unclassified Information (CUI) program?

• AExecutive Order 13556
• BExecutive Order 14028
• CExecutive Order 13526
• DExecutive Order 12829

Which organization maintains the CUI Registry, which lists all authorized CUI categories and subcategories?

• ANIST
• BDoD OUSD(I&S)
• CNARA
• DDHS CISA

What is the key distinguishing factor between FCI and CUI in the CMMC context?

• AFCI requires basic safeguarding under FAR 52.204-21 (Level 1); CUI requires enhanced prot…
• BFCI applies to civilian agencies; CUI applies only to DoD contractors
• CFCI is classified; CUI is unclassified
• DFCI requires encryption at rest; CUI requires encryption in transit

Which of the following is an example of CUI in the defense contracting context?

• AA contractor's marketing brochure submitted to the government
• BPublicly available DoD press releases
• CTechnical specifications for a defense system component marked 'DISTRIBUTION D'
• DGeneric commercial pricing data provided with a bid

NIST SP 800-171 Rev. 2 is organized into how many security requirement families?

• A17
• B20
• C6
• D14

How many total security requirements does NIST SP 800-171 Rev. 2 contain?

• A48
• B97
• C110
• D130

Which NIST SP 800-171 Rev. 2 family includes requirements for multi-factor authentication (MFA)?

• AAccess Control (AC)
• BIdentification & Authentication (IA)
• CSystem & Communications Protection (SC)
• DConfiguration Management (CM)

What is the primary purpose of a System Security Plan (SSP) under NIST SP 800-171?

• ATo document all security incidents that have occurred in the past year
• BTo provide a list of all employees with system access
• CTo request additional funding for cybersecurity improvements
• DTo describe the system boundary, the environment of operation, how security requirements…

Which NIST SP 800-171 Rev. 2 family contains requirements for media protection, including media sanitization?

• AConfiguration Management (CM)
• BAccess Control (AC)
• CPhysical Protection (PE)
• DMedia Protection (MP)

In NIST SP 800-171, what does a Plan of Action & Milestones (POA&M) document?

• AThe assessment findings of a C3PAO during a formal CMMC audit
• BEmployee training schedules for security awareness programs
• CThe organization's strategic business plan for the next five years
• DSecurity deficiencies, including planned remediation steps, resources required, and sched…

NIST SP 800-171 Rev. 2 requirement 3.1.1 requires that system access be limited to authorized users. What additional control does 3.1.2 add?

• ARequiring multi-factor authentication for all users
• BLimiting system access to the types of transactions and functions that authorized users a…
• CEncrypting all data at rest on organizational systems
• DMaintaining audit logs of all user access attempts

Which NIST SP 800-171 Rev. 2 family specifically includes requirements for security awareness and training?

• ARisk Assessment (RA)
• BPersonnel Security (PS)
• CSecurity Assessment (CA)
• DAwareness & Training (AT)

What is the current version of NIST SP 800-171 that CMMC Level 2 assessments use as their baseline?

• ANIST SP 800-171 Rev. 2
• BNIST SP 800-171 Rev. 1
• CNIST SP 800-171 Rev. 3
• DNIST SP 800-171B

What is the purpose of CMMC scoping?

• ATo determine which employees require security clearances
• BTo identify the systems, assets, and environments that must comply with CMMC requirements
• CTo select which CMMC practices an OSC will implement
• DTo establish the monetary value of the DoD contract

In CMMC Level 1 scoping, which types of assets are considered in scope?

• AAll assets that process, store, or transmit FCI
• BOnly hardware assets that directly process FCI
• COnly cloud assets and servers
• DAssets above a defined monetary value threshold

Which of the following is a recognized CMMC Level 2 asset category defined in the DoD Scoping Guide?

• AClassified Assets
• BRegulated Assets
• CFederal Data Assets
• DCUI Assets

What is a 'Specialized Asset' in the CMMC scoping context?

• AAn asset worth more than $1 million that requires enhanced protection
• BGovernment-furnished equipment (GFE), IoT/OT devices, or test equipment that cannot fully…
• CA cloud service provider's asset that is exempt from CMMC
• DAny asset that processes more than 1,000 CUI records per day

When an OSC uses a cloud service provider (CSP) to store CUI, what CMMC scoping consideration applies?

• AThe CSP is automatically out of scope if it holds a commercial cloud contract
• BOnly CSPs with CMMC Level 2 certification can store CUI
• CCloud storage is always in scope regardless of authorization status
• DThe CSP must meet FedRAMP Moderate (or equivalent) authorization to be considered for CUI…

For CMMC Level 1, is a written System Security Plan (SSP) required as a formal deliverable?

• ANo, there are no formal documentation requirements at Level 1, though an SSP is recommend…
• BYes, but only for contracts exceeding $10 million
• CNo, SSP requirements were eliminated in CMMC 2.0 entirely
• DYes, a fully detailed SSP is mandatory for Level 1 certification

What is the primary goal of the Cyber AB Code of Professional Conduct (CoPC)?

• ATo set pricing standards for CMMC advisory services
• BTo establish ethical standards and professional obligations for all Cyber AB ecosystem pa…
• CTo define the technical requirements for CMMC Level 3
• DTo provide marketing guidelines for RPOs