100+ Free CMMC CCI Practice Questions

Explanation: ISACA was authorized as the CAICO for the US Department of War's CMMC program in December 2025, taking over training and credentialing oversight from Cyber AB. The full transition of services was completed by April 1, 2026. ISACA now manages the CCP, CCA, LCCA, and CCI credentials.

Explanation: An OSC is a defense contractor or subcontractor that processes, stores, or transmits FCI or CUI and must achieve a CMMC certification level as required by its DoD contracts. The OSC undergoes self-assessment or third-party assessment depending on the required level and contract type.

Explanation: Under CMMC rules, a CCI with a valid CCP certification may instruct CCP candidates only. A CCI who also holds a valid CCA certification may instruct CCP, CCA, and CCI candidates. The instructor's own credential level gates the courses they are authorized to teach.

Explanation: C3PAOs are organizations accredited by Cyber AB to conduct CMMC Level 2 certification assessments of OSCs. They employ Certified CMMC Professionals (CCPs) and Certified CMMC Assessors (CCAs) to perform the assessments. DIBCAC conducts Level 3 assessments, while RPOs and RPs provide advisory services, not certification assessments.

Explanation: CMMC 2.0 has three levels. Level 1 (Foundational) focuses on basic cyber hygiene to protect Federal Contract Information (FCI). Level 2 (Advanced) aligns with all 110 NIST SP 800-171 Rev. 2 requirements for CUI protection. Level 3 (Expert) adds 24 enhanced requirements from NIST SP 800-172 to defend against Advanced Persistent Threats (APTs).

Explanation: CMMC Level 1 requires 15 basic cyber hygiene practices specified in FAR Clause 52.204-21(b)(1) to protect Federal Contract Information (FCI). Earlier CMMC documentation referenced 17 requirements, but the final 32 CFR rule consolidated them to 15. These practices cover foundational safeguarding such as limiting system access and protecting information from unauthorized disclosure.

Explanation: CMMC Level 2 maps directly to all 110 security requirements in NIST SP 800-171 Rev. 2, which is the standard for protecting Controlled Unclassified Information (CUI) on nonfederal systems. These 110 requirements are organized into 14 control families and collectively have 320 assessment objectives that must be satisfied.

Explanation: The 14 NIST SP 800-171 control families are: Access Control (AC), Awareness and Training (AT), Audit and Accountability (AU), Configuration Management (CM), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Personnel Security (PS), Physical Protection (PE), Risk Assessment (RA), Security Assessment (CA), System and Communications Protection (SC), and System and Information Integrity (SI). A CCI must know these domains precisely.

Explanation: NIST SP 800-172 provides enhanced security requirements to protect CUI associated with critical programs against Advanced Persistent Threats (APTs). CMMC Level 3 adds 24 selected requirements from the February 2021 version of NIST SP 800-172 on top of the 110 Level 2 requirements. Level 3 organizations also undergo DIBCAC assessment every three years.

Explanation: CMMC Level 3 certification assessments are conducted exclusively by DCMA's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Before a Level 3 assessment can begin, the OSC must have already achieved a Final Level 2 status through a C3PAO assessment, with all POA&M items closed.