I85PREP
⌘ K
CMMC CCI study materials
CMMC CCI study resources

CMMC CCI practice questions

One question at a time. Build your CMMC CCI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1CMMC Ecosystem and Instructor Role

In the CMMC ecosystem, what is the primary role of a Certified CMMC Instructor (CCI)?

  1. Author the CMMC assessment methodology for the Department of Defense
  2. Conduct C3PAO assessments of contractor networks
  3. Deliver authorized CMMC training and administer associated assessments for candidates Correct answer.
  4. Serve as the final adjudicator of Plan of Action and Milestones approvals

Explanation

A CCI is credentialed to deliver CMMC training content and administer the associated assessments within the authorized training program. Assessment of contractor networks is performed by assessors and C3PAOs, not instructors. The methodology is owned by the Department of Defense, and POA&M approval rests with the requiring official.

Question 2CMMC Ecosystem and Instructor Role

Which organization owns and administers the CMMC program, including the accreditation of the training and assessment ecosystem?

  1. The General Services Administration
  2. The Department of Defense Correct answer.
  3. The Cybersecurity and Infrastructure Security Agency
  4. The National Institute of Standards and Technology

Explanation

The Department of Defense owns the CMMC program and oversees the accreditation body that manages the broader ecosystem. NIST publishes the underlying security standards such as SP 800-171, but does not run CMMC. GSA and CISA are federal agencies with related missions but no ownership of CMMC.

Question 3CMMC Ecosystem and Instructor Role

A candidate asks who may deliver official CMMC training content to defense contractors. Which answer is most accurate?

  1. Any federal contracting officer who has completed the training
  2. Only instructors affiliated with an authorized training provider and holding the required instructor credential Correct answer.
  3. Any employee of a certified C3PAO
  4. Any security professional with five years of assessment experience

Explanation

Official CMMC training must be delivered through the authorized provider structure by instructors who hold the appropriate credential. Experience alone, C3PAO employment, or contracting officer status does not confer authority to teach official content. This protects consistency and integrity of the training.

Question 4CMMC Ecosystem and Instructor Role

What is the relationship between the CMMC model levels and the protection of Federal Contract Information versus Controlled Unclassified Information?

  1. Level 1 protects CUI, while Level 2 protects only FCI
  2. Both levels apply exclusively to CUI and ignore FCI
  3. Level 1 covers CUI and Level 2 covers classified information
  4. Level 1 addresses FCI protection, while Level 2 builds on that to protect CUI Correct answer.

Explanation

Level 1 focuses on safeguarding Federal Contract Information using basic hygiene practices. Level 2 adds the full set of requirements needed to protect Controlled Unclassified Information, aligned with NIST SP 800-171. Classified information is outside the scope of CMMC entirely.

Question 5CMMC Ecosystem and Instructor Role

During a CMMC training session, a learner asks how the CMMC model relates to NIST SP 800-171. Which response is correct?

  1. CMMC Level 1 is derived from the full NIST SP 800-171 requirement set
  2. NIST SP 800-171 is optional guidance that CMMC assessors may ignore
  3. CMMC replaces NIST SP 800-171 with an unrelated control set
  4. CMMC Level 2 requirements are drawn from the security requirements in NIST SP 800-171 Correct answer.

Explanation

The Level 2 requirement set is built on the security requirements of NIST SP 800-171, so the two are closely linked. CMMC does not discard that standard or treat it as optional. Level 1 is a smaller subset of basic safeguarding practices rather than the full requirement set.

Question 6CMMC Ecosystem and Instructor Role

An instructor is preparing to teach a CMMC fundamentals course and must confirm the governing requirement source for Level 1 practices. Which source is correct?

  1. The 110 security requirements of NIST SP 800-171
  2. The 800 controls of NIST SP 800-53 Revision 5
  3. The 51 practices in the CMMC Level 3 overlay
  4. The 17 practices of the basic safeguarding requirement set derived from FAR 52.204-21 Correct answer.

Explanation

Level 1 is built on the basic safeguarding requirements reflected in FAR 52.204-21, commonly expressed as 17 practices. SP 800-171's 110 requirements underpin Level 2, not Level 1. SP 800-53 is a broader federal control catalog, and Level 3 extends beyond Level 2 rather than consisting of 51 practices.

Question 7CMMC Ecosystem and Instructor Role

A learner asserts that once a company achieves a CMMC certification, the certification never expires. How should the instructor correct this?

  1. Certifications are renewed automatically each year without any action
  2. Certifications remain valid indefinitely unless the company changes ownership
  3. Certifications expire only when a new CMMC level is published
  4. Certifications are valid for a defined period and require reaffirmation or recertification Correct answer.

Explanation

CMMC certifications have a defined validity period, after which the organization must undergo the appropriate reaffirmation or recertification activity. They are not perpetual, nor are they automatically renewed without action. Publication of a new level does not by itself void existing certifications.

Question 8CMMC Ecosystem and Instructor Role

Which statement best describes the difference between a CMMC assessment performed by a C3PAO and a self-assessment?

  1. Both are identical in method and differ only in the report format
  2. A self-assessment is always more rigorous than a C3PAO assessment
  3. A C3PAO assessment is an independent third-party evaluation, while a self-assessment is performed by the organization itself Correct answer.
  4. A C3PAO assessment applies only to Level 1, while self-assessment applies to Level 2

Explanation

A C3PAO assessment is conducted by an independent accredited third party, providing external validation. A self-assessment is performed internally by the organization against the applicable requirements. The two differ in independence and rigor, not merely in reporting format.

Question 9CMMC Ecosystem and Instructor Role

What is the purpose of a Plan of Action and Milestones in the CMMC context?

  1. To replace the need for any assessment of the identified requirements
  2. To record only requirements that were fully met at the time of assessment
  3. To document how unmet requirements will be remediated, with owners and timelines Correct answer.
  4. To list the instructors authorized to teach at the organization

Explanation

A POA&M records requirements that are not yet satisfied and describes the remediation approach, responsible parties, and target dates. It does not remove the obligation to meet requirements or substitute for assessment. It concerns unmet requirements, not fully satisfied ones, and has nothing to do with instructor rosters.

Question 10CMMC Ecosystem and Instructor Role

An instructor is explaining the CMMC assessment ecosystem. Which pairing of role to responsibility is correct?

  1. Assessor - conducts evaluation activities against CMMC requirements Correct answer.
  2. Accreditation body - performs every contractor assessment personally
  3. C3PAO - certifies individual instructors
  4. Instructor - issues CMMC certifications to organizations

Explanation

Assessors perform the evaluation activities that determine whether requirements are met. The accreditation body oversees the ecosystem rather than conducting every assessment personally. C3PAOs conduct organizational assessments, and instructors deliver training, so neither certifies instructors or issues organizational certifications.

Question 11CMMC Ecosystem and Instructor Role

A student asks which CMMC level a contractor should pursue when the contract requires protection of Controlled Unclassified Information. Which answer is most appropriate?

  1. No level applies because CUI is outside CMMC scope
  2. Level 3, because it is the minimum for any CUI
  3. Level 2, because it addresses the full set of CUI protection requirements Correct answer.
  4. Level 1, because it covers all CUI requirements

Explanation

Level 2 is aligned with the full NIST SP 800-171 requirement set for protecting CUI. Level 1 addresses basic safeguarding of FCI and is insufficient for CUI. Level 3 adds enhanced requirements beyond Level 2 rather than serving as the minimum, and CUI is squarely within CMMC scope.

Question 12CMMC Ecosystem and Instructor Role

Which activity falls outside the legitimate scope of a Certified CMMC Instructor's duties?

  1. Delivering approved course content according to the provider's schedule
  2. Issuing a C3PAO assessment certification to a contractor Correct answer.
  3. Coaching learners on how to interpret CMMC requirements
  4. Administering the assessments associated with the training

Explanation

Issuing C3PAO assessment certifications belongs to accredited third-party assessment organizations, not instructors. Instructors deliver approved content, help learners interpret requirements, and administer training assessments. Overstepping into certification issuance would confuse two distinct ecosystem roles.

Question 13CMMC Ecosystem and Instructor Role

An instructor wants learners to understand why the CMMC model uses maturity levels rather than a single pass/fail checklist. Which rationale is most accurate?

  1. Levels exist so contractors can choose whichever requirements are cheapest
  2. Levels allow incremental progression that reflects increasing sensitivity of the information handled Correct answer.
  3. Levels ensure every contractor implements identical technology products
  4. Levels are purely administrative and carry no security meaning

Explanation

Maturity levels let organizations progress from basic safeguarding toward more comprehensive protection as the sensitivity of information increases. Cost convenience is not the design rationale, and the levels carry real security meaning. They specify practices and processes, not specific technology products.

Question 14CMMC Ecosystem and Instructor Role

A learner asks how CMMC requirements are structured at Level 2. Which description is correct?

  1. They are organized by instructor lesson plan rather than by security domain
  2. They are organized solely by assessment objective with no domain grouping
  3. They are grouped into domains and practices, each with associated assessment objectives Correct answer.
  4. They consist only of process maturity scores with no practice statements

Explanation

Level 2 requirements are organized into security domains and practices, and each requirement has associated assessment objectives that define what must be demonstrated. They are not a flat list lacking structure, nor are they purely process scores. Lesson plans are a training artifact, not the requirement structure.

Question 15CMMC Ecosystem and Instructor Role

During class, a learner claims that a company can self-declare Level 2 compliance for a contract that mandates a C3PAO certification. How should the instructor respond?

  1. Self-declaration is always sufficient because CMMC does not require third parties
  2. The instructor can convert a self-assessment into a C3PAO certification on request
  3. The contract's stated assessment requirement governs, and a mandated C3PAO certification requires third-party assessment Correct answer.
  4. Self-declaration is acceptable whenever the company has an internal security team

Explanation

The assessment requirement specified in the contract determines what is acceptable, and a mandated C3PAO certification cannot be satisfied by self-declaration. Internal staffing does not change the contractual requirement. Instructors cannot convert assessment results into third-party certifications.

Question 16CMMC Ecosystem and Instructor Role

What distinguishes Level 3 from Level 2 in the CMMC model?

  1. Level 3 removes several Level 2 requirements to reduce burden
  2. Level 3 is identical to Level 2 but uses a different assessment form
  3. Level 3 adds enhanced security requirements on top of the Level 2 baseline Correct answer.
  4. Level 3 applies only to companies handling no federal data

Explanation

Level 3 builds on the Level 2 baseline by adding enhanced requirements for the most sensitive programs. It does not remove Level 2 requirements or merely change paperwork. Companies handling no federal data would not be pursuing CMMC levels at all.

Question 17CMMC Ecosystem and Instructor Role

An instructor is asked to explain the term 'assessment objective' to a class. Which explanation is accurate?

  1. A waiver that exempts a company from a requirement
  2. A financial milestone used to budget for certification
  3. A statement that defines what an assessor must examine to determine whether a requirement is satisfied Correct answer.
  4. A list of approved training vendors for a contract

Explanation

Assessment objectives translate requirements into specific, examinable conditions that an assessor evaluates to determine satisfaction. They are not financial milestones, vendor lists, or waivers. Understanding them helps learners see how requirements become auditable evidence.

Question 18CMMC Ecosystem and Instructor Role

Which statement about the CMMC accreditation body's function is most accurate?

  1. It teaches all CMMC courses directly to contractors
  2. It accredits and oversees assessment organizations and credentialed professionals in the ecosystem Correct answer.
  3. It writes the Federal Acquisition Regulation clauses used in contracts
  4. It awards defense contracts to certified companies

Explanation

The accreditation body accredits and oversees the organizations and professionals that make up the assessment and training ecosystem. It does not deliver all training directly, award contracts, or author the FAR. Those functions belong to training providers, contracting authorities, and regulators respectively.

Question 19CMMC Ecosystem and Instructor Role

A learner asks whether an instructor may tailor official CMMC course content to shorten it. What is the best guidance?

  1. Instructors must deliver the approved content as specified by the provider and program requirements Correct answer.
  2. Instructors may substitute their own assessment methodology for the official one
  3. Instructors may omit any domain they find difficult to teach
  4. Instructors may freely rewrite official content to fit any schedule

Explanation

Instructors are expected to deliver approved content consistent with program and provider requirements, which preserves quality and consistency across candidates. Free rewriting, omitting domains, or substituting a personal methodology would undermine the credential's integrity. Any flexibility must stay within authorized bounds.

Question 20CMMC Ecosystem and Instructor Role

An instructor notices a learner repeatedly misrepresenting CMMC certification status to other students. What is the most appropriate instructor action?

  1. Correct the misinformation, reinforce the accurate requirement, and follow provider escalation procedures Correct answer.
  2. Change the course content to avoid the topic
  3. Publicly certify the learner to resolve the dispute
  4. Ignore the conduct because it occurs outside the formal assessment

Explanation

Instructors are responsible for maintaining accurate information and professional conduct in the learning environment, which means correcting misinformation and escalating through provider channels when needed. Ignoring it allows false claims to spread, and an instructor cannot grant certifications. Altering content to dodge the topic fails the learners.

Question 21CMMC Ecosystem and Instructor Role

A student asks which document a contractor uses to describe the boundary of the environment where CUI is handled during an assessment. Which answer is correct?

  1. The assessment scope definition that identifies assets, systems, and locations relevant to CUI Correct answer.
  2. The training attendance roster
  3. The company's marketing brochure
  4. The instructor's course syllabus

Explanation

Assessment scope identifies the assets, systems, people, and locations relevant to the protection of CUI, establishing what the assessment covers. A syllabus, brochure, or attendance roster has no role in defining assessment scope. Clear scoping is essential for a credible evaluation.

Question 22CMMC Ecosystem and Instructor Role

Which statement correctly characterizes the relationship between CMMC certification and a contractor's eligibility for a specific DoD contract?

  1. Only Level 3 certification is ever referenced in contracts
  2. Contract requirements specify the level and assessment type that must be met for consideration Correct answer.
  3. Certification is irrelevant to any DoD contract
  4. Certification guarantees contract award to the certified company

Explanation

Contracts state the required CMMC level and assessment type, and meeting that requirement is a condition for consideration. Certification does not guarantee an award, since many other factors affect source selection. It is not irrelevant, and contracts can reference various levels depending on the information involved.

Question 23CMMC Ecosystem and Instructor Role

An instructor is designing a lesson on evidence for assessment objectives. Which example best illustrates acceptable evidence for a practice requiring multifactor authentication?

  1. A vendor's general marketing claim about security
  2. A verbal assurance from an employee during class
  3. A configuration screenshot and policy showing MFA enforced for the scoped systems Correct answer.
  4. A plan to implement MFA in a future year

Explanation

Acceptable evidence demonstrates that the practice is implemented in the scoped environment, such as configuration settings and enforcing policy. Marketing claims, verbal assurances, and future plans do not show current implementation. This distinction is central to how assessors evaluate objectives.

Question 24CMMC Ecosystem and Instructor Role

Which of the following best explains why instructors must stay current with CMMC program updates?

  1. Staying current allows instructors to certify companies directly
  2. Updates only affect the color scheme of official slides
  3. Program requirements and assessment expectations evolve, and outdated instruction would mislead candidates Correct answer.
  4. Currency is required only for assessors, not instructors

Explanation

The CMMC program evolves, and instructors are responsible for teaching accurate, current requirements and expectations. Currency is not a cosmetic or assessor-only concern. Keeping up to date does not extend an instructor's authority to certify organizations.

Question 25CMMC Ecosystem and Instructor Role

A learner asks what 'Level 1 self-assessment' typically involves for a small contractor. Which description is most accurate?

  1. An instructor-issued certificate of compliance
  2. An internal review of the basic safeguarding practices with documented results and an annual affirmation Correct answer.
  3. A penetration test conducted by the accreditation body
  4. A full C3PAO-led evaluation with a formal certification

Explanation

Level 1 self-assessment involves the organization reviewing the basic safeguarding practices, documenting results, and providing the required annual affirmation. It is not a C3PAO-led certification, a penetration test, or an instructor-issued certificate. This reflects the lower-rigor path associated with FCI protection.

Question 26CMMC Ecosystem and Instructor Role

An instructor is describing the overall structure of the CMMC program to a new cohort. Which statement correctly identifies how the model organizes its practices and processes?

  1. Practices are grouped only by system boundary and assessed once at contract award
  2. Practices and processes are grouped into domains and assessed across progressive maturity levels Correct answer.
  3. Domains apply only to Level 3 and above, while Levels 1 and 2 use a single checklist
  4. Processes are optional and practices are assessed only at Level 1

Explanation

The CMMC model organizes security practices and institutionalization processes into domains, and those requirements accumulate across progressive maturity levels. Each higher level builds on the requirements of the levels beneath it rather than replacing them.

Question 27CMMC Ecosystem and Instructor Role

A learner asks who within a training organization typically holds accountability for ensuring that CMMC course deliveries reflect the current authorized curriculum. Which answer is most accurate?

  1. The training provider's authorized program management, which maintains curriculum control and instructor eligibility Correct answer.
  2. The C3PAO conducting the students' future assessments
  3. The student cohort, which votes on which content to cover
  4. The individual instructor acting alone, with no organizational oversight

Explanation

Authorized training providers operate under program management that controls curriculum versioning, instructor authorization, and quality. Individual instructors deliver within that framework rather than owning the curriculum independently.

Question 28CMMC Ecosystem and Instructor Role

During a lesson on the CMMC phased rollout, an instructor explains that requirements are introduced over time rather than all at once. Which statement best captures the intent of phasing?

  1. Phasing gives the defense industrial base time to adapt while contract clauses progressively incorporate requirements Correct answer.
  2. Phasing applies only to prime contractors and never to subcontractors
  3. Phasing removes the need for contracts to specify a level
  4. Phasing lets contractors choose whichever level they prefer to be assessed against

Explanation

Phased implementation is designed to give the defense industrial base time to prepare while contract clauses increasingly incorporate CMMC requirements. The applicable level is driven by the contract, not by contractor preference.

Question 29CMMC Ecosystem and Instructor Role

A student asks what the CMMC accreditation body does in the ecosystem. Which description is most accurate?

  1. It adjudicates contract disputes between primes and subcontractors
  2. It authorizes and oversees assessment and training organizations within the program Correct answer.
  3. It directly assesses every contractor that handles CUI
  4. It writes the security controls that contractors must implement

Explanation

The accreditation body authorizes, trains, and oversees the organizations and individuals that participate in the ecosystem, such as C3PAOs and authorized training providers. It does not itself conduct every assessment or write the underlying security controls.

Question 30CMMC Ecosystem and Instructor Role

An instructor wants learners to understand why the CMMC model uses maturity levels rather than a single pass/fail checklist. Which rationale is most defensible?

  1. Levels let an organization demonstrate progressively stronger and more institutionalized security practices matched to contract sensitivity Correct answer.
  2. Levels allow contractors to skip documentation for lower-risk contracts
  3. Levels replace the need for any evidence during assessment
  4. Levels exist so that assessors can shorten the assessment to a single interview

Explanation

Maturity levels express increasing rigor and institutionalization so that requirements can be matched to the sensitivity of the information handled. Higher levels add process institutionalization on top of practices rather than simply lengthening a checklist.

Question 31CMMC Ecosystem and Instructor Role

An instructor is preparing to teach a CMMC fundamentals course and must confirm the governing requirement source for Level 2 practices. Which source should the instructor point learners to?

  1. The instructor's own consolidated notes from prior classes
  2. The federal protection standard for controlled unclassified information, as incorporated into the CMMC model Correct answer.
  3. The contractor's internal security policy manual
  4. A vendor's product hardening guide

Explanation

Level 2 practices trace to the federal standard for protecting CUI as incorporated into the CMMC model, which is why instructors should teach from the authoritative source. Internal policies and vendor guides may implement requirements but do not define them.

Question 32CMMC Ecosystem and Instructor Role

A learner asks what a Level 1 self-assessment typically involves for a small contractor. Which description is most accurate?

  1. A documented internal review of required practices against evidence, with results affirmed by a senior official Correct answer.
  2. A penetration test performed by an external red team
  3. An annual on-site visit by a C3PAO team
  4. A certification issued by the training provider that taught the staff

Explanation

A Level 1 self-assessment is an internal, documented review of the required practices against evidence, concluded with a senior official's affirmation. It does not involve a third-party assessment team or a training provider acting as certifier.

Question 33CMMC Ecosystem and Instructor Role

During class, a learner claims a company can self-declare Level 2 compliance for a contract that mandates a C3PAO certification. How should the instructor respond?

  1. Suggest the learner ask the training provider to issue the certification instead
  2. Agree, because self-declaration always satisfies Level 2 requirements
  3. Explain that the contract's stated requirement controls, and a mandated third-party certification cannot be replaced by self-declaration Correct answer.
  4. Recommend the company skip assessment and rely on its internal audit report

Explanation

The assessment mechanism is determined by what the contract requires; where a third-party certification is mandated, self-declaration does not satisfy it. Instructors should redirect learners to the contract clauses and the program's assessment rules.

Question 34CMMC Ecosystem and Instructor Role

An instructor is designing a lesson on evidence for assessment objectives. Which example best illustrates acceptable evidence?

  1. A dated configuration export from the system of record showing the setting was applied Correct answer.
  2. A statement in the company brochure that security is a priority
  3. A verbal assurance from an employee during a hallway conversation
  4. A slide deck describing the security program in general terms

Explanation

Acceptable evidence is verifiable, attributable, and tied to the specific objective, such as a dated system export showing the actual configuration. General descriptions and verbal assurances do not demonstrate that a practice is implemented.

Question 35CMMC Ecosystem and Instructor Role

A learner asks which document a contractor uses to describe the boundary of the environment where CUI is handled during an assessment. Which answer is correct?

  1. The company's organizational chart
  2. The Plan of Action and Milestones
  3. The system security plan and its associated boundary documentation Correct answer.
  4. The certificate of completion from instructor-led training

Explanation

The system security plan and its supporting boundary documentation define what is in scope for the assessment and how CUI is handled within it. The POA&M tracks remediation, not the boundary definition.

Question 36CMMC Ecosystem and Instructor Role

An instructor notices a learner repeatedly telling classmates that the learner's employer is 'CMMC certified' when no assessment has occurred. What is the most appropriate instructor action?

  1. Ignore it because statements made by learners are outside the instructor's responsibility
  2. Confirm the claim so the learner does not lose credibility
  3. Publicly accuse the learner of fraud in front of the class
  4. Privately correct the misstatement, explain why accurate claims matter, and restate the program's rules on certification claims Correct answer.

Explanation

Instructors have a duty to correct material misstatements about certification status because inaccurate claims can mislead contracting partners and violate program expectations. A private correction preserves dignity while reinforcing accurate terminology and rules.

Question 37CMMC Ecosystem and Instructor Role

Which statement correctly characterizes the relationship between CMMC certification and a contractor's eligibility for a contract requiring it?

  1. Certification is a prerequisite the contractor must hold to be eligible when the solicitation requires it Correct answer.
  2. Certification is irrelevant because contracting officers cannot consider it
  3. Certification guarantees award of the contract once obtained
  4. Certification can be replaced by a self-attestation in every circumstance

Explanation

Where a solicitation requires CMMC certification, holding the required certification is a condition of eligibility. It does not guarantee award, because technical merit, price, and other factors still govern the decision.

Question 38CMMC Ecosystem and Instructor Role

An instructor is explaining why certification status has a time limit. Which statement should the instructor make?

  1. Certification lapses whenever an employee leaves the company
  2. Certification is permanent once achieved and never revisited
  3. Certification expires only if the contractor changes its name
  4. Certification is valid for a defined period and must be renewed through reassessment Correct answer.

Explanation

CMMC certification is valid for a defined period and requires reassessment to renew, which keeps the demonstrated security posture current. It is not a one-time, permanent designation.

Question 39CMMC Ecosystem and Instructor Role

A student asks which CMMC level a contractor should pursue when the contract requires protection of controlled unclassified information. Which guidance is most accurate?

  1. The contractor should pick the lowest level to reduce cost
  2. The contractor should wait until after award to determine any level
  3. The contractor should always pursue Level 3 regardless of contract terms
  4. The contractor should follow the level specified in the contract, which for CUI protection is typically Level 2 Correct answer.

Explanation

The requiring contract specifies the applicable level, and contracts involving CUI typically specify Level 2 requirements. Contractors should align their preparation to the contractual requirement rather than choosing a level by preference.

Question 40CMMC Ecosystem and Instructor Role

An instructor wants to teach the difference between a practice and a process in the CMMC model. Which example best illustrates a process requirement?

  1. A documented, repeatable management activity showing the practice is institutionalized Correct answer.
  2. A firewall rule blocking a particular port
  3. A specific configuration setting applied to a server
  4. A list of authorized users for an application

Explanation

Process requirements address institutionalization, meaning the management activities that make practices repeatable and reviewed over time. Configuration settings, firewall rules, and user lists are examples of practices rather than processes.

Question 41CMMC Ecosystem and Instructor Role

An instructor is asked how artificial intelligence tools should be used when preparing CMMC course materials. Which approach is most defensible?

  1. Use tools as drafting aids while verifying accuracy against authoritative sources and protecting controlled or proprietary content Correct answer.
  2. Avoid all technology and rely solely on memory
  3. Paste proprietary curriculum into any public tool to speed drafting
  4. Use tools only to generate learner certification claims

Explanation

Tools can assist drafting, but the instructor remains accountable for accuracy and for protecting sensitive or proprietary material. Verification against authoritative sources is essential because generated content can be outdated or wrong.

Question 42CMMC Ecosystem and Instructor Role

A learner asks what the Plan of Action and Milestones does when an assessment identifies unmet requirements. Which answer is most accurate?

  1. It documents the remediation actions, owners, and target dates for closing identified gaps Correct answer.
  2. It replaces the need to remediate the gaps
  3. It lists only the requirements the organization already meets
  4. It certifies the organization at the next level

Explanation

A POA&M records how identified gaps will be closed, including actions, responsible parties, and schedules. It supports remediation management and does not itself confer certification or excuse unmet requirements.

Question 43CMMC Ecosystem and Instructor Role

An instructor is building a lesson on how instructors should respond when a learner asks a question the instructor cannot answer confidently. Which response best models professional practice?

  1. Deflect the question and change the topic
  2. Invent a plausible answer so the class keeps moving
  3. Tell the learner the question is out of scope for the course
  4. Acknowledge the gap, commit to verifying against authoritative sources, and follow up with the accurate answer Correct answer.

Explanation

Accurate instruction requires acknowledging uncertainty and verifying answers against authoritative sources rather than guessing. Following up preserves learner trust and prevents the spread of incorrect information.

Question 44CMMC Ecosystem and Instructor Role

A learner asks why the CMMC ecosystem separates the organizations that train from the organizations that assess. Which explanation is most defensible?

  1. Separation exists because assessors are not permitted to read documentation
  2. Separation reduces conflicts of interest so that preparation and evaluation of compliance remain independent Correct answer.
  3. Separation is a cost-saving measure with no integrity purpose
  4. Separation allows training providers to issue certifications on the assessor's behalf

Explanation

Keeping training and assessment in separate authorized roles protects the integrity of certification by preventing an organization from evaluating its own students. Independence ensures that assessment conclusions are not influenced by training relationships.

Question 45CMMC Ecosystem and Instructor Role

An instructor is asked whether achieving Level 2 certification means an organization has satisfied every Level 3 practice. Which response is correct?

  1. Yes, because higher levels are subsets of lower levels
  2. No, because Level 2 certification has no relationship to the model's levels
  3. Yes, because certification covers all levels simultaneously
  4. No, because Level 3 adds practices and process maturity requirements beyond Level 2 Correct answer.

Explanation

Levels are cumulative in the sense that higher levels build on lower ones, but Level 3 introduces additional practices and process institutionalization that Level 2 does not assess. A Level 2 certification therefore does not demonstrate satisfaction of Level 3 requirements.

Question 46CMMC Ecosystem and Instructor Role

A learner proposes that an organization under a Level 2 requirement can define its own assessment scope to exclude a business unit that occasionally handles CUI. How should the instructor evaluate this proposal?

  1. Accept it, because contractors define scope without constraint
  2. Accept it, because occasional handling never brings assets into scope
  3. Reject it, because scope must account for where CUI is actually handled and cannot be narrowed to avoid inconvenient assets Correct answer.
  4. Reject it, because only the contracting officer may define technical scope

Explanation

Assessment scope must reflect the reality of where CUI is stored, processed, or transmitted; artificially excluding such assets undermines the assessment. Instructors should stress that scope definition is an accuracy exercise, not a cost-avoidance exercise.

Question 47CMMC Ecosystem and Instructor Role

An instructor is comparing how evidence sufficiency is judged across assessment objectives. Which principle should guide the class?

  1. Evidence must be sufficient, relevant, and reliable for the specific objective being examined Correct answer.
  2. Assessors accept any document the contractor prefers to submit
  3. A single screenshot always satisfies any objective regardless of the practice
  4. Evidence sufficiency is determined solely by the number of pages provided

Explanation

Assessors judge whether evidence is sufficient, relevant, and reliable for the particular objective, which varies by practice. Volume alone does not establish sufficiency, and the contractor's preference does not set the standard.

Question 48CMMC Ecosystem and Instructor Role

An instructor is outlining the CMMC ecosystem for a new cohort and asks learners to identify which body owns the CMMC program itself, including the model, assessment guides, and program direction. Which answer should the instructor confirm as correct?

  1. The C3PAO that performs the certification assessment for the contractor
  2. The Department of Defense, through the office that administers the CMMC program Correct answer.
  3. The training provider that delivers the CMMC credential course
  4. The Certified Assessor who signs the assessment findings

Explanation

The CMMC program is a Department of Defense initiative, and DoD sets the model, the assessment guidance, and the direction of the program as it matures. Assessors, C3PAOs, and training providers all operate inside the ecosystem that DoD defines, but none of them owns or governs the program.

Question 49CMMC Ecosystem and Instructor Role

A learner preparing to become a CMMC instructor asks how the instructor role differs from the assessor role during a Level 2 engagement at a contractor. Which description should the instructor give?

  1. The instructor certifies the organization's compliance, while the assessor delivers the required annual training
  2. The instructor drafts the assessment findings for the assessor to sign, while the assessor only reviews the draft
  3. The instructor teaches the requirements and how to interpret them, while the assessor independently evaluates whether the organization meets them Correct answer.
  4. The instructor and the assessor share the same accreditation and may swap duties on the same engagement

Explanation

Instructors build understanding of the requirements and how organizations should interpret and implement them, but they do not judge compliance. Assessors from an accredited C3PAO perform the independent evaluation and determine whether assessment objectives are met. Keeping these roles separate protects the integrity of the assessment.

Question 50CMMC Ecosystem and Instructor Role

During a class discussion, a learner says that because the instructor holds a CMMC-related instructor credential, the learner's company can cite the instructor as its assessor for an upcoming Level 2 certification. How should the instructor analyze this proposal?

  1. Decline, because Level 2 certification requires no external assessor and can be self-declared in all cases
  2. Decline, because assessment must be performed by an accredited C3PAO using authorized assessors, and an instructor credential does not confer that authority Correct answer.
  3. Accept, because instructor and assessor credentials are issued against the same body of knowledge and are interchangeable
  4. Accept, provided the instructor documents the engagement in the organization's system security plan

Explanation

Certification assessments must be conducted by a C3PAO accredited for that purpose, staffed by assessors authorized under the program. An instructor credential shows competence in teaching the material, not authority to assess and certify an organization. Accepting the proposal would produce a certification with no valid basis.