Free CCP Practice Questions

Question 1

An inspection technician signs in with an individually assigned account and successfully completes authentication. The technician is authorized to enter inspection results but discovers that the same account can approve engineering changes, a function reserved for supervisors. Which safeguard has failed?

Accepted Answer

Restricting the transactions and functions available to an authorized user.

Answer

Identifying and distinguishing individual users before granting them access to the system.

Answer

Verifying the user's claimed identity before allowing a system session.

Answer

Limiting connections to devices approved to access the organization's systems.

Question 2

A defense contractor prepares a nonpublic production-status report required by its federal contract. The government confirms that no Controlled Unclassified Information (CUI) category applies. The report bears neither a CUI banner nor a proprietary legend. How should the report be treated?

Accepted Answer

As Federal Contract Information (FCI), despite the absence of a marking.

Answer

As contractor proprietary information only, because the contractor generated the report.

Answer

As CUI, because information supporting a defense contract requires that designation.

Answer

As publicly releasable information, unless the government adds an explicit control marking.

Question 3

For an organization's Level 2 assessment, an outsourced provider manages endpoint-protection policies for the CUI environment and retains security configuration data and alerts. The provider does not process, store, or transmit CUI and is not a cloud service provider. Which scope entry correctly describes these services?

Accepted Answer

Security Protection Assets, assessed within the organization's scope against requirements relevant to the services.

Answer

Out-of-scope services, because the provider handles security data rather than the organization's CUI.

Answer

CUI Assets, because administering protections for the environment makes the provider a CUI processor.

Answer

Separately certified services, excluded from the organization's assessment once the provider obtains its own CMMC certificate.

Question 4

A Level 2 certification assessment ends with five NOT MET security requirements, each carrying a one-point deduction. One requirement has three failed objectives; each of the other four has one. The five include AC.L2-3.1.20, External Connections. All other requirements are MET, and the contractor proposes placing all five on a plan of action and milestones (POA&M). Which score and status determination is correct?

Accepted Answer

105 points; Conditional Level 2 is unavailable because External Connections cannot be deferred on a POA&M.

Answer

103 points; Conditional Level 2 is available because the score remains above the minimum.

Answer

105 points; Conditional Level 2 is available because every outstanding requirement is worth one point.

Answer

103 points; Conditional Level 2 is unavailable because External Connections cannot be deferred on a POA&M.

Question 5

Before repurposing contractor-owned solid-state drives from an FCI file server for public demonstration kiosks, a contractor applies a media-appropriate sanitization method and verifies successful completion. Records identify each drive by serial number. Considering the FAR basic safeguarding requirement alone, what should a CCP conclude?

Accepted Answer

Verified sanitization permits reuse; destruction is not additionally required.

Answer

Each drive must be physically destroyed because its previous use involved FCI.

Answer

The drives may be reused only within the original contract's assessed environment.

Answer

Reuse must await written approval from the government's contracting officer.

Question 6

A C3PAO schedules a Level 2 certification assessment with a Lead CCA and a CCP as the only assessment-team members. An independent CCA will review the completed assessment for quality assurance. All three meet their respective credentialing and background-investigation requirements. Does this staffing meet the assessment-team requirement?

Accepted Answer

No; the assessment team needs another CCA in addition to the Lead CCA.

Answer

Yes; the Lead CCA can supervise the CCP as the required second assessment-team member.

Answer

Yes; the independent quality-assurance CCA counts toward the minimum number of assessment-team members.

Answer

No; a CCP may collect evidence during readiness work but cannot participate in a certification assessment.

Question 7

While a CCP collects evidence in a live environment, shared files begin changing names and a ransom demand appears. The assessment team has read-only authorization; system administration belongs to the organization's response personnel. The assessment plan identifies an incident contact and the Lead CCA. What takes priority?

Accepted Answer

Alert the incident contact and Lead CCA, and suspend evidence collection on the affected systems.

Answer

Finish copying the affected files so the team has complete evidence before notifying the organization.

Answer

Ask the administrator to reboot the affected servers before the team escalates the suspected incident.

Answer

Direct an immediate shutdown of the entire environment, then notify the designated incident contact.

Question 8

A public web server and an internal FCI file server run on shared virtualization hardware. Separate virtual networks and enforced firewall rules isolate the public component; authorized testing confirms that separation. A reviewer proposes rejecting the design because the servers do not occupy separate physical hosts. Under the public-access system separation requirement, which response is justified?

Accepted Answer

Accept the demonstrated logical separation; dedicated physical hosts are not required.

Answer

Require separate hosts because logical isolation does not address the shared hardware.

Answer

Accept the design on the strength of HTTPS rather than the demonstrated network separation.

Answer

Require separate Internet connections so the public and internal systems cannot share an entry point.

Question 9

'We should assess against the newest NIST revision, not the one used when the CMMC rule was written,' a consultant argues. For a CMMC Level 2 assessment governed by the current 32 CFR Part 170, which approach correctly establishes the criteria?

Accepted Answer

Use Revision 2 of NIST SP 800-171 as incorporated into the CMMC regulation.

Answer

Use Revision 3 of NIST SP 800-171 because publication supersedes the rule's incorporated requirements.

Answer

Use whichever revision the contractor names in its system security plan, provided it is applied consistently.

Answer

Assess only requirements appearing in both revisions until the contracting officer issues a replacement clause.

Question 10

A server-room visitor signs in, receives a numbered badge, and is recorded continuously by security cameras. The host then leaves the visitor to work alone, although the visitor is not authorized for unescorted access. The access log and badge records are complete. Which assessment of the Level 1 visitor-protection requirement is supported?

Accepted Answer

It is NOT MET because monitoring does not replace the missing escort.

Answer

It is MET because the visitor's identity, entry time, and activity are all recorded.

Answer

It is MET because the host approved the visit and issued a badge for access.

Answer

It can be marked MET if the missing escort is entered on a corrective-action plan.

Free CCP Practice Questions

Domain 1: CMMC Ecosystem 5% of exam

Question 1

Domain 3: CMMC Governance and Source Documents 15% of exam

Question 2

Question 3

Domain 4: CMMC Model Construct and Implementation Evaluation 35% of exam

Question 4

Question 5

Question 6

Question 7

Domain 5: CMMC Assessment Process (CAP) 25% of exam

Question 8

Question 9

Domain 6: Scoping 15% of exam

Question 10

The rest of the CCP blueprint

That's 10 of 1,030