I85PREP
⌘ K
CMMC-RP study materials
CMMC-RP study resources

CMMC-RP practice questions

One question at a time. Build your CMMC-RP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1CMMC Ecosystem and Governance

In the CMMC ecosystem, which organization serves as the authorizing body that oversees the program and maintains the CMMC model and assessment guidance?

  1. The National Institute of Standards and Technology (NIST), which issues CMMC certifications
  2. The Defense Contract Management Agency (DCMA), which accredits C3PAOs
  3. The Cyber AB, which owns the CMMC standard and publishes the assessment methodology
  4. The Department of Defense Chief Information Officer (DoD CIO), acting through the CMMC Program Management Office Correct answer.

Explanation

The DoD CIO, supported by the CMMC Program Management Office, is the program owner that maintains the CMMC model, scoping guidance, and assessment materials. The Cyber AB is an accreditation body for the assessment ecosystem, not the author of the CMMC requirement itself, and NIST publishes the underlying SP 800-171 controls.

Question 2CMMC Ecosystem and Governance

A defense contractor wants to know which document defines the specific security requirements that make up each CMMC level. Which CMMC artifact should the contractor consult?

  1. The CMMC Model document Correct answer.
  2. The CMMC Assessment Process (CAP) guide
  3. The DFARS 252.204-7012 clause
  4. The NIST SP 800-53 control catalog

Explanation

The CMMC Model document lays out the levels and the practices and processes required at each level. The CAP describes how assessments are conducted, DFARS 7012 establishes safeguarding and reporting obligations, and SP 800-53 is a broader control catalog that informs but does not define CMMC levels.

Question 3CMMC Ecosystem and Governance

Which entity is responsible for accrediting Certified Third-Party Assessment Organizations (C3PAOs) within the CMMC ecosystem?

  1. The Defense Counterintelligence and Security Agency (DCSA)
  2. The CMMC Accreditation Body, known as The Cyber AB Correct answer.
  3. The DoD CIO's CMMC Program Management Office
  4. The prime contractor that sponsors the subcontractor

Explanation

The Cyber AB is the accreditation body recognized by DoD to authorize C3PAOs and certify individual assessors. DCSA handles other industrial security functions, and the PMO sets program policy rather than performing organization-level accreditation.

Question 4CMMC Ecosystem and Governance

A company holds a CMMC Level 2 self-assessment and later needs a Level 2 certification assessment because a new contract requires it. Which statement describes the correct path?

  1. The company engages an authorized C3PAO to conduct the Level 2 certification assessment Correct answer.
  2. The company requests that DCMA convert the self-assessment into a joint surveillance review
  3. The company must first obtain a Level 1 certification before it can be assessed at Level 2
  4. The company submits its self-assessment evidence to the DoD CIO for automatic conversion to a certification

Explanation

Level 2 certification assessments are performed by an authorized C3PAO, which evaluates implementation against the Level 2 practices and issues a certification result valid for the defined period. Self-assessment results are not automatically converted into certifications by any government office.

Question 5CMMC Ecosystem and Governance

Which body develops and maintains the CMMC Assessment Process (CAP) that C3PAOs follow when conducting certification assessments?

  1. The DoD CMMC Program Management Office Correct answer.
  2. The CMMC Trade Association
  3. The prime contractor's security office
  4. The Cyber AB, through its assessment methodology committee

Explanation

The CAP is developed and maintained under the DoD CMMC program, with the PMO responsible for the assessment methodology used across the ecosystem. The Cyber AB handles accreditation and training, not authorship of the government's assessment process.

Question 6CMMC Ecosystem and Governance

A subcontractor is told by its prime that it must achieve CMMC Level 2 certification. Which mechanism most commonly creates that obligation for the subcontractor?

  1. A voluntary pledge made to The Cyber AB
  2. A DFARS clause flowed down through the subcontract Correct answer.
  3. A NIST SP 800-171 self-assessment posted to the Supplier Performance Risk System
  4. An internal corporate policy adopted by the subcontractor's board

Explanation

CMMC requirements reach subcontractors primarily through DFARS clause flow-down in the subcontract, which incorporates the applicable CMMC level. A SPRS self-assessment score is a separate reporting obligation and does not by itself impose a certification level.

Question 7CMMC Ecosystem and Governance

Which statement best describes the relationship between NIST SP 800-171 and CMMC Level 2?

  1. CMMC Level 2 aligns only with ISO/IEC 27001 and ignores SP 800-171
  2. CMMC Level 2 incorporates the SP 800-171 security requirements and adds assessment and process maturity expectations Correct answer.
  3. CMMC Level 2 replaces SP 800-171 entirely with a new control set
  4. CMMC Level 2 is limited to the 17 practices drawn from FAR 52.204-21

Explanation

Level 2 builds on the SP 800-171 security requirements while adding CMMC-specific assessment rigor and process maturity expectations. Level 1, not Level 2, corresponds to the basic safeguarding practices associated with FAR 52.204-21.

Question 8CMMC Ecosystem and Governance

Which CMMC level corresponds to the basic safeguarding requirements historically associated with FAR 52.204-21?

  1. Level 1 Correct answer.
  2. Level 4
  3. Level 2
  4. Level 3

Explanation

Level 1 is the foundational level built on the basic safeguarding requirements reflected in FAR 52.204-21. Level 2 incorporates the more extensive SP 800-171 requirements, and Level 3 adds enhanced practices above Level 2.

Question 9CMMC Ecosystem and Governance

What is the primary role of a Certified Assessor within the CMMC ecosystem?

  1. To conduct assessment activities and document objective evidence for a C3PAO assessment Correct answer.
  2. To approve a company's System Security Plan on behalf of the DoD CIO
  3. To accredit new C3PAOs on behalf of The Cyber AB
  4. To manage the SPRS submission on behalf of the assessed company

Explanation

Certified Assessors are credentialed individuals who perform assessment activities and gather objective evidence under a C3PAO. They do not accredit organizations, approve SSPs for the government, or act as the company's SPRS submitter.

Question 10CMMC Ecosystem and Governance

Which organization operates the Supplier Performance Risk System (SPRS) where contractors post their NIST SP 800-171 self-assessment scores?

  1. The General Services Administration
  2. The Cyber AB
  3. The Small Business Administration
  4. The Department of Defense Correct answer.

Explanation

SPRS is a Department of Defense system used to record contractor self-assessment scores and related supplier risk information. The Cyber AB is an accreditation body, and SBA and GSA do not operate SPRS.

Question 11CMMC Ecosystem and Governance

A small defense supplier is pursuing CMMC Level 1. Which assessment approach is consistent with the program for that level?

  1. A Level 3 certification assessment performed by a government assessor
  2. An annual self-assessment with an affirmation of compliance, with no C3PAO certification required Correct answer.
  3. A mandatory C3PAO certification assessment every year
  4. A joint DCMA and DCSA surveillance review

Explanation

Level 1 uses an annual self-assessment with a senior official affirmation rather than a third-party certification. C3PAO certification assessments are associated with Level 2 certification, and government-led assessments apply at Level 3.

Question 12CMMC Ecosystem and Governance

Which statement accurately describes the CMMC Level 3 assessment approach in the current program?

  1. It relies solely on a self-assessment with no external review
  2. It is conducted by the government, using DoD assessors, and builds on Level 2 certification Correct answer.
  3. It is waived for companies that already hold ISO/IEC 27001 certification
  4. It is performed by any C3PAO without additional government involvement

Explanation

Level 3 assessments are government-led and layered on top of the Level 2 certification, adding enhanced practices drawn from selected SP 800-172 requirements. A C3PAO alone cannot satisfy the Level 3 assessment, and no certification waives it.

Question 13CMMC Ecosystem and Governance

What is the purpose of a senior official affirmation in the CMMC self-assessment process?

  1. To provide a formal attestation by a company leader that the self-assessment results are accurate Correct answer.
  2. To certify the company's C3PAO for future assessments
  3. To transfer legal liability for security incidents to the assessor
  4. To authorize the DoD to share the results publicly

Explanation

The affirmation is a formal attestation by a senior company official that the self-assessment and its results are accurate. It does not shift liability to assessors, accredit any organization, or authorize public release of results.

Question 14CMMC Ecosystem and Governance

Which of the following best describes the scope of the CMMC ecosystem's accreditation activities performed by The Cyber AB?

  1. Approving the security controls in NIST SP 800-171
  2. Accrediting C3PAOs and certifying individual assessors who perform CMMC assessments Correct answer.
  3. Issuing CMMC certifications directly to defense contractors
  4. Setting the DFARS contract clauses that require CMMC

Explanation

The Cyber AB accredits C3PAOs and certifies the individual assessors who carry out assessments. It does not certify contractors directly, write DFARS clauses, or author NIST publications.

Question 15CMMC Ecosystem and Governance

A company is preparing for a Level 2 certification assessment. Which document should it use to understand how assessors will score and close out practices?

  1. The NIST SP 800-171A assessment procedures alone
  2. The CMMC Assessment Process (CAP) guide Correct answer.
  3. The DFARS 252.204-7012 clause text
  4. The CMMC Model appendix listing practices only

Explanation

The CAP guide describes how assessments are planned, conducted, scored, and closed out, making it the key reference for assessment mechanics. The model lists requirements, and SP 800-171A provides assessment procedures but not the CMMC program's full assessment process.

Question 16CMMC Ecosystem and Governance

Which CMMC level introduces enhanced security requirements drawn from selected NIST SP 800-172 controls?

  1. Level 1
  2. Level 2
  3. Level 3 Correct answer.
  4. Level 2 self-assessment

Explanation

Level 3 adds enhanced requirements selected from NIST SP 800-172 on top of the Level 2 requirements. Level 1 and Level 2 do not incorporate the SP 800-172 enhanced controls.

Question 17CMMC Ecosystem and Governance

A contractor asks whether its CMMC certification can be transferred to a subsidiary that operates the same network. Which response is most accurate?

  1. Certification transfers whenever the subsidiary uses the same internet service provider
  2. Certification applies to the assessed entity and its defined scope, so a separate entity generally needs its own assessment Correct answer.
  3. Certification transfers automatically to any parent or subsidiary in the same corporate family
  4. Certification can be transferred if the subsidiary pays a transfer fee to The Cyber AB

Explanation

A CMMC certification is tied to the assessed organization and the scope defined during the assessment. A different legal entity generally requires its own assessment unless it falls within the assessed scope, and no transfer fee or shared service provider creates automatic transfer.

Question 18CMMC Ecosystem and Governance

Which statement best describes the difference between a CMMC self-assessment and a CMMC certification assessment?

  1. A self-assessment requires a C3PAO, while a certification assessment is performed internally
  2. A self-assessment is performed internally by the company, while a certification assessment is conducted by an authorized C3PAO Correct answer.
  3. Both are performed by government assessors but differ only in duration
  4. A certification assessment is only available at Level 1

Explanation

Self-assessments are conducted by the company itself, whereas certification assessments are performed by an authorized C3PAO. The other descriptions reverse the roles or misstate which levels use certification.

Question 19CMMC Ecosystem and Governance

Which body maintains the CMMC model content that defines practices and processes across levels?

  1. The DoD CMMC Program Management Office Correct answer.
  2. The CMMC Assessor Guild
  3. The Defense Contract Audit Agency
  4. The Cyber AB

Explanation

The CMMC PMO within DoD maintains the model content, including practices and process requirements. The Cyber AB handles accreditation, DCAA performs contract audits, and no entity called the CMMC Assessor Guild authors the model.

Question 20CMMC Ecosystem and Governance

A company's CMMC certification is nearing expiration and it wants to remain certified. What is the expected action?

  1. Complete a reassessment before the certification expires to maintain certification status Correct answer.
  2. Take no action because certifications renew automatically
  3. Submit a letter to The Cyber AB requesting a permanent extension
  4. Rely on its SPRS score to extend the certification

Explanation

Certifications are time-limited, and maintaining status requires a reassessment within the certification period before expiration. Certifications do not auto-renew, and SPRS scores do not extend certification validity.

Question 21CMMC Ecosystem and Governance

Which statement accurately characterizes the CMMC phased implementation approach announced by DoD?

  1. CMMC requirements apply only to contracts awarded before 2020
  2. CMMC requirements took effect for all contracts simultaneously on a single date
  3. CMMC requirements are optional for all contractors at every phase
  4. CMMC requirements are being introduced incrementally across contract phases, with self-assessment requirements appearing before certification requirements Correct answer.

Explanation

DoD phased the implementation so that requirements enter contracts incrementally, with self-assessment obligations beginning earlier and certification requirements following in later phases. The program did not apply to all contracts on one date and is not optional.

Question 22CMMC Ecosystem and Governance

What is the role of the CMMC Accreditation Body's training and credentialing program for assessors?

  1. It certifies defense contractors at Level 2
  2. It approves the security controls in the CMMC model
  3. It issues DFARS deviations for contractors
  4. It prepares and credentials individuals to serve as certified assessors on C3PAO assessment teams Correct answer.

Explanation

The accreditation body runs training and credentialing so individuals can qualify as certified assessors who support C3PAO assessments. It does not certify contractors, issue DFARS deviations, or approve model controls.

Question 23CMMC Ecosystem and Governance

A company wants to challenge an assessment finding it believes is incorrect. Which path is most consistent with the CMMC ecosystem?

  1. Refuse to pay the C3PAO until the finding is withdrawn
  2. Ask the prime contractor to delete the finding from the assessment report
  3. Submit a new SPRS score that overrides the finding
  4. Use the dispute or appeals process defined in the assessment program and C3PAO procedures Correct answer.

Explanation

Disagreements with assessment findings are handled through the formal dispute or appeals mechanisms defined by the assessment program and the C3PAO's procedures. Withholding payment, altering SPRS data, or asking a prime to delete findings are not valid resolution paths.

Question 24CMMC Ecosystem and Governance

Which statement best describes how CMMC requirements are intended to protect the defense industrial base?

  1. They apply only to companies that voluntarily join the program
  2. They eliminate the need for incident reporting to DoD
  3. They replace all federal cybersecurity regulations with a single voluntary framework
  4. They establish a verified, tiered set of cybersecurity requirements that contractors must demonstrate they meet Correct answer.

Explanation

CMMC creates a tiered requirement set with verification so that contractors demonstrate implementation of appropriate safeguards. It does not replace all federal regulations, is not voluntary when included in contracts, and does not remove incident reporting obligations.

Question 25CMMC Ecosystem and Governance

Which entity typically performs a Level 2 certification assessment for a contractor?

  1. A DCMA industrial security representative
  2. The prime contractor's security compliance office
  3. The contractor's internal audit team
  4. An authorized C3PAO using certified assessors Correct answer.

Explanation

Level 2 certification assessments are conducted by an authorized C3PAO staffed with certified assessors. Internal teams, DCMA representatives, and prime contractor offices do not issue CMMC Level 2 certifications.

Question 26CMMC Ecosystem and Governance

In the CMMC program, which term describes the organization that owns or operates the network enclave where controlled unclassified information is processed, stored, or transmitted and that must meet the model's practices?

  1. The DoD program office sponsoring the contract
  2. The assessed entity seeking certification Correct answer.
  3. The Cyber AB registered provider organization
  4. The prime contractor's contracting officer

Explanation

CMMC obligations attach to the entity whose environment handles controlled unclassified information and that undergoes assessment; that organization is the assessed entity. Contracting officers and program offices administer contracts, and registered provider organizations supply assessment services rather than receiving certification.

Question 27CMMC Ecosystem and Governance

Which document type does the CMMC program require an assessed entity to maintain so that assessors can verify how each practice is implemented, including artifacts, evidence, and responsible personnel?

  1. A quarterly shareholder report
  2. An objectives and evidence record mapped to practices Correct answer.
  3. A marketing capability statement
  4. A statement of work for subcontractors

Explanation

Assessment depends on evidence mapped to each practice, commonly documented as objectives with associated artifacts and responsible owners. Without that mapping, an assessor cannot determine whether a practice is actually met.

Question 28CMMC Ecosystem and Governance

A contractor is deciding whether a cloud service provider's environment falls inside its CMMC assessment scope. Which principle governs that decision?

  1. Scope is limited to assets listed in the contractor's insurance policy
  2. Scope is determined by whether the asset processes, stores, or transmits CUI or provides security protection for such assets Correct answer.
  3. Any cloud service is automatically out of scope
  4. Scope includes only assets physically located on the contractor's premises

Explanation

CMMC scoping follows the function of the asset: assets that handle controlled unclassified information, or that protect assets which do, are in scope regardless of hosting location. Physical location and vendor relationships do not by themselves remove an asset from scope.

Question 29CMMC Ecosystem and Governance

Which statement best describes how the CMMC model organizes its requirements for assessors and implementers?

  1. As a single maturity level with no subdivisions
  2. As a flat list of unrelated controls with no grouping
  3. As a set of financial audit standards
  4. As domains containing practices, with processes added at higher levels Correct answer.

Explanation

The model groups practices into domains and, at higher levels, adds process maturity requirements alongside practices. This structure lets assessors evaluate both what is implemented and how consistently it is managed.

Question 30CMMC Ecosystem and Governance

A contractor's Level 2 assessment is scheduled, and the contractor wants to know who may serve as the lead assessor on a certification assessment. Which credential is required?

  1. A government contracting officer designated by the contract
  2. A Certified Assessor affiliated with a certified third-party assessment organization Correct answer.
  3. A Certified Information Systems Security Professional holder employed by the contractor
  4. A registered provider organization consultant retained by the contractor

Explanation

Certification assessments are conducted by certified assessors working through a certified third-party assessment organization within the CMMC ecosystem. Other credentials, however relevant to security work, do not authorize an individual to lead a CMMC certification assessment.

Question 31CMMC Ecosystem and Governance

A subcontractor handles CUI for a prime and is told its CMMC status will flow down through the subcontract. Which statement best reflects how CMMC requirements reach subcontractors?

  1. Subcontractors are exempt because CMMC applies only to prime contractors
  2. Subcontractors are covered only if they volunteer to participate
  3. Requirements flow down through contract clauses that the prime must include in applicable subcontracts Correct answer.
  4. Requirements apply only to subcontractors located outside the United States

Explanation

CMMC obligations reach lower-tier suppliers through the contract clauses the prime is required to flow down when the subcontract involves covered information. The obligation is contractual rather than voluntary, and it does not depend on the prime-only status or on geography.

Question 32CMMC Ecosystem and Governance

Which body within the CMMC ecosystem is responsible for accrediting third-party assessment organizations and authorizing the assessors who work for them?

  1. The Defense Contract Audit Agency
  2. The General Services Administration
  3. The Cyber AB Correct answer.
  4. The National Institute of Standards and Technology

Explanation

The Cyber AB serves as the accreditation body for the CMMC ecosystem, accrediting assessment organizations and managing assessor authorization. NIST develops standards, while DCAA and GSA perform unrelated functions.

Question 33CMMC Ecosystem and Governance

A contractor is preparing for a Level 2 certification assessment and wants to understand how assessors judge whether a practice is met. Which concept should the contractor study?

  1. The contractor's own internal audit checklist from a prior year
  2. The assessment objectives that define the conditions each practice must satisfy Correct answer.
  3. The marketing materials published by its registered provider organization
  4. The contract's delivery schedule and invoicing terms

Explanation

Assessors evaluate practices against defined assessment objectives that describe what evidence must show for the practice to be considered met. Internal checklists and vendor materials may help preparation but do not define the assessment standard.

Question 34CMMC Ecosystem and Governance

A contractor has multiple enclaves, one of which handles CUI and another that supports only public-facing marketing. How should the contractor treat the marketing enclave in its CMMC boundary?

  1. Include it only if it shares an internet connection with the CUI enclave
  2. Include it because all corporate networks must be assessed
  3. Exclude it if it neither handles CUI nor provides security protection for CUI-handling assets Correct answer.
  4. Exclude it only if it is operated by a third party

Explanation

Assets that neither process, store, or transmit CUI nor protect assets that do are outside the assessment scope. Shared internet connectivity by itself does not pull an otherwise out-of-scope enclave into the boundary.

Question 35CMMC Ecosystem and Governance

Which statement best explains why the CMMC program includes an affirmation by a senior company official?

  1. It places accountability on company leadership for the accuracy of the assessment results submitted Correct answer.
  2. It transfers liability for breaches to the government
  3. It certifies that the company has no subcontractors
  4. It replaces the need for any technical assessment

Explanation

The affirmation mechanism is intended to make senior leaders personally accountable for the truthfulness of results reported to DoD. It supplements rather than replaces technical assessment and does not shift breach liability to the government.

Question 36CMMC Ecosystem and Governance

A contractor is at CMMC Level 1 and asks which requirement source underpins the Level 1 practices. Which answer is most accurate?

  1. ISO/IEC 27001 Annex A controls
  2. The full set of NIST SP 800-171 requirements
  3. The safeguarding requirements reflected in FAR 52.204-21 Correct answer.
  4. Selected NIST SP 800-172 enhanced controls

Explanation

Level 1 practices correspond to the basic safeguarding requirements associated with FAR 52.204-21, focused on protecting federal contract information. Level 2 aligns with NIST SP 800-171, and enhanced requirements appear at higher levels.

Question 37CMMC Ecosystem and Governance

A contractor's Level 2 certification lapses while it continues performing on a contract that requires certification. What is the most accurate description of the consequence under the CMMC program?

  1. The contractor must immediately surrender all CUI to the government
  2. The contractor may be ineligible for award or option exercise on contracts requiring that certification Correct answer.
  3. The lapse is recorded but has no effect on contract eligibility
  4. The contract automatically converts to a Level 1 requirement

Explanation

Certification status is used in award decisions, so a lapsed certification can make an entity ineligible for new awards or option exercises requiring that level. A lapse does not downgrade the requirement or trigger automatic data surrender.

Question 38CMMC Ecosystem and Governance

Which statement best describes the relationship between a certified third-party assessment organization and the certified assessors who work for it?

  1. The organization certifies itself and then hires uncertified staff to assess
  2. Assessors are accredited independently and need no organizational affiliation
  3. The organization is accredited, and its assessors are individually authorized to conduct assessments under that accreditation Correct answer.
  4. Assessors are authorized by the Defense Contract Management Agency

Explanation

Accreditation operates at two levels: the assessment organization is accredited, and the individuals conducting assessments hold their own credentials under that organization. Neither credential substitutes for the other.

Question 39CMMC Ecosystem and Governance

A contractor operating under a Level 1 self-assessment discovers that a required practice is not yet implemented but plans remediation within 90 days. What does the CMMC program expect regarding the self-assessment submission?

  1. The contractor should submit an affirmative result and note the gap only internally
  2. The contractor should submit results without any senior official involvement
  3. The contractor should defer all self-assessment activity until every practice is fully mature
  4. The contractor should report accurately, because a senior official affirms the results submitted Correct answer.

Explanation

Self-assessment results carry a senior official affirmation, so the entity must report its status truthfully rather than overstate compliance. Internal notes do not cure an inaccurate affirmation, and the program does not require waiting for full maturity before assessing.

Question 40CMMC Ecosystem and Governance

Which statement best captures the purpose of the CMMC phased implementation approach for DoD contracts?

  1. It replaces certification with a single self-attestation for all levels
  2. It sequences when certification requirements begin appearing in solicitations and contracts across acquisition phases Correct answer.
  3. It eliminates CMMC requirements for small businesses permanently
  4. It applies CMMC only to contracts awarded after all phases are complete

Explanation

Phased implementation staggers the introduction of CMMC requirements into solicitations and contracts over time so the industrial base can prepare. It does not remove requirements for small businesses or substitute self-attestation at every level.

Question 41CMMC Ecosystem and Governance

An assessor finds that a contractor has documented a practice but the evidence is not current for the assessment period. What is the assessor's most appropriate conclusion?

  1. The practice is met if the contractor promises future correction
  2. The practice may not be met because evidence must demonstrate implementation during the relevant period Correct answer.
  3. The practice is out of scope because documentation exists
  4. The practice is met because documentation exists

Explanation

Assessment requires evidence that a practice is implemented, not merely described. Stale evidence fails to demonstrate implementation during the period under review, so the practice may be judged not met.

Question 42CMMC Ecosystem and Governance

Which statement best describes the role of the CMMC model's process requirements at Level 2 and above?

  1. They measure financial maturity of the organization
  2. They replace the need to implement technical practices
  3. They evaluate whether practices are institutionalized through documented, repeatable management Correct answer.
  4. They apply only to prime contractors and never to subcontractors

Explanation

Process maturity requirements examine whether practices are managed consistently, with documented policy, planning, and oversight. They complement practice implementation rather than replacing it, and they are not financial measures.

Question 43CMMC Ecosystem and Governance

A contractor wants to use a managed service provider to satisfy several practices in its CUI environment. How does the CMMC program treat this arrangement?

  1. Outsourcing removes those practices from the contractor's assessment scope entirely
  2. The contractor may rely on the provider only if the provider is a registered provider organization
  3. The contractor remains responsible for ensuring the practices are met for in-scope assets, even when a provider performs the work Correct answer.
  4. The provider must obtain its own Level 2 certification before the contractor can rely on it

Explanation

Responsibility for meeting practices stays with the assessed entity for its in-scope environment, even when a service provider performs operational work. The provider's own compliance status does not transfer the contractor's obligation.

Question 44CMMC Ecosystem and Governance

Which statement best describes how CMMC assessment results are recorded and used within DoD acquisition?

  1. Results are transmitted only to the contractor's insurance carrier
  2. Results are published publicly on the contractor's website
  3. Results are kept confidential within the assessing organization and never shared
  4. Results are reported into a DoD system of record so contracting officials can verify status Correct answer.

Explanation

Assessment outcomes are recorded in a DoD system so that acquisition officials can confirm an entity's status when evaluating eligibility. Results are not confined to the assessor or published as public web content.

Question 45CMMC Ecosystem and Governance

A contractor believes a specific practice does not apply because of how its environment is architected. What is the most appropriate basis for that position within CMMC?

  1. A decision by the contractor's registered provider organization
  2. A documented scoping determination showing the relevant asset or requirement is outside the assessment boundary Correct answer.
  3. The contractor's own judgment that the practice is inconvenient
  4. A verbal agreement with the contracting officer

Explanation

Exclusions must rest on documented scoping determinations tied to the assessment boundary, not on convenience or informal agreement. Assessors evaluate the documented rationale rather than accepting assertions.

Question 46CMMC Ecosystem and Governance

Which statement best describes the CMMC program's treatment of Plans of Action and Milestones at Level 2?

  1. A POA&M can close every open practice with no effect on the assessment outcome
  2. POA&Ms are prohibited at Level 2
  3. POA&Ms replace the need for a certification assessment
  4. Limited open practices may be addressed through a POA&M within defined conditions, and the assessor evaluates whether those conditions are satisfied Correct answer.

Explanation

The program permits a defined, limited use of POA&Ms for certain open practices, subject to conditions the assessor verifies. A POA&M is not a mechanism for leaving all practices open, and it does not eliminate the assessment itself.

Question 47CMMC Ecosystem and Governance

Which statement best describes the difference between the CMMC model and the assessment process?

  1. The model is optional guidance, while the assessment process is mandatory for all companies
  2. The model defines required practices and processes, while the assessment process determines whether an entity meets them Correct answer.
  3. The model applies only to cloud providers, while the assessment process applies to primes
  4. The model and the assessment process are identical documents

Explanation

The model is the requirement set, and the assessment process is the method used to evaluate conformance with it. Treating the two as interchangeable or as an optional guidance document misstates how the program operates.

Question 48CMMC Ecosystem and Governance

A company is choosing between a self-assessment and a certification assessment for a given level. Which factor determines the applicable path?

  1. The company's annual revenue
  2. The company's preferred assessment vendor
  3. The number of employees in the security team
  4. The level and the requirements of the solicitation or contract Correct answer.

Explanation

The applicable assessment path depends on the level and what the relevant solicitation or contract requires. Company size and vendor preference do not determine whether self-assessment or certification applies.

Question 49CMMC Ecosystem and Governance

Which statement best describes how the CMMC ecosystem handles conflicts of interest between consulting and assessment activities?

  1. Conflicts of interest are irrelevant because assessments are objective
  2. The contractor's contracting officer resolves all conflicts of interest
  3. A single organization may freely consult and then certify the same client
  4. Consulting and certification assessment roles are separated so that an assessor does not certify work it helped implement Correct answer.

Explanation

The ecosystem separates consulting from certification assessment to preserve objectivity, so an organization that helped implement practices does not then certify them. This separation is a structural safeguard rather than something left to the assessed entity or contracting officer.

Question 50CMMC Ecosystem and Governance

A contractor is preparing evidence for a Level 2 assessment and wants to know how many practices it must address. Which statement is most accurate?

  1. The contractor addresses the full set of Level 2 practices applicable to its in-scope environment Correct answer.
  2. The contractor addresses a random sample of practices chosen by DoD
  3. The contractor addresses only practices related to access control
  4. The contractor addresses only the practices its assessor selects at the opening meeting

Explanation

Level 2 assessment covers the full set of Level 2 practices applicable to the entity's in-scope environment rather than a sample or a subset chosen by the assessor. Selectivity by domain or at the opening meeting is not how the requirement set is applied.