I85PREP
⌘ K
CMMC Foundation study materials
CMMC Foundation study resources

CMMC Foundation practice questions

One question at a time. Build your CMMC Foundation understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1CMMC Ecosystem Overview

In the CMMC ecosystem, which organization owns and administers the CMMC program, including the publication of the CMMC model and assessment rules?

  1. The Department of Defense, through the Office of the Under Secretary of Defense for Acquisition and Sustainment Correct answer.
  2. The CMMC Accreditation Body, operating as an independent nonprofit
  3. The General Services Administration, through the Federal Acquisition Regulation Council
  4. The National Institute of Standards and Technology, through its cybersecurity framework program

Explanation

The CMMC program is a Department of Defense initiative, and DoD policy, model content, and assessment requirements are issued under the Office of the Under Secretary of Defense for Acquisition and Sustainment. NIST publishes the underlying standards such as SP 800-171, but it does not own the CMMC program itself.

Question 2CMMC Ecosystem Overview

Which statement best describes the role of the CMMC Accreditation Body within the ecosystem?

  1. It develops and publishes the NIST SP 800-171 security requirements
  2. It performs C3PAO assessments on behalf of the Department of Defense
  3. It authorizes and oversees the training and assessment provider organizations that support CMMC Correct answer.
  4. It issues the contracts that contain CMMC requirements for defense suppliers

Explanation

The accreditation body is the independent organization recognized by DoD to implement the accreditation infrastructure, which includes authorizing C3PAOs, certifying assessors, and approving training providers. It does not itself conduct the assessments or write the underlying security standards.

Question 3CMMC Ecosystem Overview

A defense contractor must obtain a Level 2 certification. Which type of organization is authorized to conduct that assessment for most contractors?

  1. A Certified Third-Party Assessment Organization Correct answer.
  2. An internal assessment team from the contractor's own staff
  3. A registered provider organization chosen by the contractor
  4. A Defense Contract Management Agency industrial specialist

Explanation

Level 2 certification for most contractors is performed by a Certified Third-Party Assessment Organization, known as a C3PAO, whose assessors are individually certified and whose organization is authorized by the accreditation body. Self-assessment is a separate pathway reserved for specified circumstances.

Question 4CMMC Ecosystem Overview

What distinguishes a Registered Practitioner from a Certified Professional in the CMMC ecosystem?

  1. The Registered Practitioner completes foundational training, while the Certified Professional passes a certification examination and meets additional requirements Correct answer.
  2. The Registered Practitioner is authorized to sign CMMC certificates, while the Certified Professional only advises clients
  3. The Registered Practitioner must hold a security clearance, while the Certified Professional does not
  4. The Registered Practitioner must work for a C3PAO, while the Certified Professional works only for the government

Explanation

Registered Practitioner status is achieved through foundational training and indicates awareness of the model, whereas Certified Professional status requires passing a formal examination and meeting further qualification criteria. Only the higher certification supports roles such as serving on assessment teams.

Question 5CMMC Ecosystem Overview

A company wants help interpreting CMMC requirements and preparing evidence before an assessment. Which provider category is designed for that advisory support?

  1. A Registered Provider Organization Correct answer.
  2. A Certified Third-Party Assessment Organization
  3. A Federally Funded Research and Development Center
  4. A Defense Industrial Base Cybersecurity Assessment Center

Explanation

Registered Provider Organizations are authorized to offer consulting, preparation, and advisory services to defense contractors seeking CMMC compliance. They are deliberately kept separate from assessment to preserve independence.

Question 6CMMC Ecosystem Overview

Why does the CMMC ecosystem separate organizations that provide consulting from organizations that perform certification assessments?

  1. To prevent a conflict of interest in which an assessor could profit from deficiencies it helped create Correct answer.
  2. To limit the number of companies eligible to receive defense contracts
  3. To reduce the cost of assessments by allowing one firm to do both tasks under a single contract
  4. To ensure that only government employees can review assessment evidence

Explanation

Independence is a core design principle of the CMMC ecosystem: an organization that prepares a contractor should not also certify that contractor, because the assessor's judgment could be compromised. Separating these roles protects the credibility of the certification.

Question 7CMMC Ecosystem Overview

Which document type does the CMMC model use to organize its security practices into domains and capabilities?

  1. A catalog of contractual data item descriptions
  2. A registry of cleared defense contractors
  3. A list of approved encryption products
  4. A maturity model with practices mapped to process and practice maturity levels Correct answer.

Explanation

The CMMC model is structured as a maturity model in which practices are grouped into domains and capabilities and organized by level, with process maturity assessed alongside practice maturity. This structure is what allows the model to scale from foundational hygiene to advanced protection.

Question 8CMMC Ecosystem Overview

How many maturity levels does the CMMC model define, and what do they represent?

  1. Three levels, representing increasing sophistication of cybersecurity practices and process maturity Correct answer.
  2. Five levels, representing the tiers of the federal acquisition workforce
  3. Four levels, representing the number of assessment types available to contractors
  4. Two levels, representing self-assessment versus third-party assessment only

Explanation

The CMMC model defines three progressive levels, each building on the prior one and combining cybersecurity practices with process maturity requirements. Level 1 covers foundational safeguarding, while higher levels add more rigorous practices and institutionalized processes.

Question 9CMMC Ecosystem Overview

A small contractor handles only Federal Contract Information and seeks the entry-level certification. Which level and assessment approach align with that situation?

  1. Level 1, typically satisfied through an annual self-assessment with affirmations Correct answer.
  2. Level 1, requiring a C3PAO assessment before each contract award
  3. Level 3, requiring government-led assessment by DIBCAC
  4. Level 2, requiring a C3PAO assessment every three years

Explanation

Level 1 focuses on safeguarding Federal Contract Information and is generally demonstrated through an annual self-assessment with senior official affirmation. Third-party assessment is associated with Level 2 and above.

Question 10CMMC Ecosystem Overview

Which information category triggers the requirement to protect Controlled Unclassified Information under CMMC Level 2?

  1. Publicly released technical manuals
  2. Controlled Unclassified Information processed or stored on contractor systems Correct answer.
  3. Internal human resources newsletters
  4. Marketing materials distributed to defense agencies

Explanation

Level 2 is aimed at protecting Controlled Unclassified Information, which requires the security requirements drawn from NIST SP 800-171. Federal Contract Information at Level 1 involves a narrower safeguarding obligation.

Question 11CMMC Ecosystem Overview

Which standard provides the security requirements that underpin CMMC Level 2 practices?

  1. ISO/IEC 27001:2022
  2. NIST SP 800-53 Revision 5
  3. NIST Cybersecurity Framework 2.0
  4. NIST SP 800-171 Revision 2 Correct answer.

Explanation

Level 2 practices are based on the security requirements in NIST SP 800-171 Revision 2, which addresses protecting CUI in nonfederal systems. The other frameworks inform broader security programs but are not the direct basis for Level 2.

Question 12CMMC Ecosystem Overview

How does the CMMC model describe the relationship between Level 1 and Level 2 practices?

  1. Level 1 and Level 2 contain identical practices but differ only in assessment frequency
  2. Level 2 is optional for contractors that already hold Level 1 certification
  3. Level 2 builds on Level 1 by adding practices and requiring institutionalized processes Correct answer.
  4. Level 2 replaces Level 1 practices with an entirely separate set

Explanation

The levels are cumulative: a contractor at Level 2 must also satisfy the Level 1 practices, and the model adds process maturity expectations as levels increase. This cumulative design allows contractors to progress rather than restart.

Question 13CMMC Ecosystem Overview

What is the primary purpose of the affirmations that senior officials provide in the CMMC process?

  1. To attest that the assessment results and compliance status are accurate and complete Correct answer.
  2. To transfer legal liability for breaches from the contractor to the government
  3. To confirm that the contractor has purchased cybersecurity insurance
  4. To certify that all employees hold appropriate security clearances

Explanation

Affirmations are a governance mechanism in which a senior company official attests to the truth of the compliance status reported to DoD. They create accountability at the leadership level rather than shifting liability or certifying unrelated matters.

Question 14CMMC Ecosystem Overview

A contractor holds a Level 2 certification and later adds a new system that processes CUI. What does the ecosystem expect regarding the certification?

  1. The contractor must immediately surrender the certification and begin a new initial assessment
  2. The certification remains valid unchanged because it applies to the legal entity regardless of systems
  3. The contractor may defer any action until the next scheduled triennial assessment
  4. The contractor should notify its C3PAO and manage the change under the program's requirements for maintaining certification Correct answer.

Explanation

Certifications are not static; the program expects contractors and their C3PAOs to manage significant changes that could affect compliance, with notification and possible reassessment. Ignoring changes until the next cycle would undermine the assurance the certificate provides.

Question 15CMMC Ecosystem Overview

What is the role of the Defense Industrial Base Cybersecurity Assessment Center in the CMMC ecosystem?

  1. It publishes the annual list of approved encryption algorithms
  2. It performs government-led assessments for the highest level and supports DoD oversight of the program Correct answer.
  3. It accredits C3PAOs and issues their certificates of authorization
  4. It provides free consulting to small businesses preparing for Level 1

Explanation

The assessment center, known as DIBCAC, conducts government-led assessments, particularly for the most sensitive programs, and supports DoD's oversight of assessment quality. Accreditation of C3PAOs is a function of the accreditation body, not DIBCAC.

Question 16CMMC Ecosystem Overview

Which statement accurately describes how CMMC requirements reach a defense contractor?

  1. They are incorporated into contracts through acquisition regulations and contract clauses Correct answer.
  2. They apply only after a contractor volunteers for a certification assessment
  3. They are imposed by the accreditation body through direct enforcement letters
  4. They apply automatically to any company that registers in the federal procurement system

Explanation

CMMC obligations become binding through the acquisition process: DoD incorporates the requirements into solicitations and contracts via regulatory provisions and clauses. Registration in a procurement system alone does not create the obligation.

Question 17CMMC Ecosystem Overview

Why does the CMMC ecosystem include a code of ethics and professional conduct for assessors?

  1. To promote integrity, objectivity, and confidentiality in assessment activities Correct answer.
  2. To standardize the fees that C3PAOs may charge contractors
  3. To guarantee that every assessment results in certification
  4. To restrict assessors from working with more than one C3PAO

Explanation

A professional code establishes expectations for integrity, objectivity, confidentiality, and competence so that assessment results are trustworthy and consistent. It does not set prices or guarantee outcomes.

Question 18CMMC Ecosystem Overview

A contractor is preparing for a Level 2 assessment and wants to know what evidence the C3PAO will examine. Which description is most accurate?

  1. Financial statements proving the contractor can afford remediation
  2. A self-reported questionnaire with no supporting artifacts
  3. Only a signed policy manual, because documentation alone demonstrates practice implementation
  4. Objective evidence such as configurations, records, interviews, and observed system settings Correct answer.

Explanation

Assessors evaluate objective evidence, which includes documentation, system configurations, logs, records, and interviews with personnel, to determine whether practices are actually implemented. A policy manual alone does not demonstrate that a practice operates effectively.

Question 19CMMC Ecosystem Overview

Which statement best captures the difference between a self-assessment and a third-party certification assessment in the CMMC program?

  1. Self-assessment is performed by the contractor against the model, while third-party certification is performed by an authorized C3PAO Correct answer.
  2. Self-assessment is performed by DIBCAC, while third-party certification is performed by the accreditation body
  3. Self-assessment and third-party certification use entirely different practice sets with no overlap
  4. Self-assessment applies only to Level 3, while third-party certification applies only to Level 1

Explanation

In a self-assessment, the contractor evaluates its own implementation and affirms the results, whereas a third-party certification involves an authorized C3PAO conducting an independent assessment. Both pathways draw on the same model practices appropriate to the level.

Question 20CMMC Ecosystem Overview

What does a C3PAO's certificate of authorization from the accreditation body signify?

  1. The organization is approved to sell cybersecurity software to defense contractors
  2. The organization has achieved Level 3 certification for its own systems
  3. The organization may issue CMMC requirements in government contracts
  4. The organization is approved to conduct CMMC assessments within its authorized scope Correct answer.

Explanation

A certificate of authorization confirms that a C3PAO has met the accreditation body's requirements and may perform assessments within its authorized scope. It does not confer authority over contracts or certify the organization's own systems.

Question 21CMMC Ecosystem Overview

A contractor's Level 2 certificate was issued after a successful assessment. What is the typical validity period before reassessment is required under the program?

  1. Three years Correct answer.
  2. Five years
  3. One year
  4. Two years

Explanation

Level 2 third-party certifications are generally valid for three years, after which reassessment is required to maintain the certification. Annual affirmations continue during that period to keep the compliance status current.

Question 22CMMC Ecosystem Overview

Which scenario best illustrates the concept of a managed service provider's role in the CMMC ecosystem?

  1. An MSP that hosts CUI for a contractor and must therefore support the contractor's compliance evidence for shared systems Correct answer.
  2. An MSP that issues CMMC certificates on behalf of the accreditation body
  3. An MSP that writes the contract clauses requiring CMMC compliance
  4. An MSP that conducts Level 2 assessments as a substitute for a C3PAO

Explanation

Service providers that store or process CUI on behalf of a contractor are part of the contractor's compliance boundary, and their controls and evidence must support the contractor's assessment. They do not, however, issue certificates or write contract requirements.

Question 23CMMC Ecosystem Overview

What is the purpose of the CMMC model's process maturity dimension at higher levels?

  1. To count the number of security tools deployed in the environment
  2. To rank contractors by the size of their defense contracts
  3. To measure whether security practices are institutionalized and consistently applied across the organization Correct answer.
  4. To determine the fee a C3PAO may charge for an assessment

Explanation

Process maturity evaluates whether practices are managed, reviewed, and sustained over time rather than performed ad hoc. This institutionalization dimension distinguishes a mature program from one that merely has controls documented.

Question 24CMMC Ecosystem Overview

Which entity typically maintains the public listing where contractors can find authorized C3PAOs and their scopes?

  1. The Department of Justice, through its procurement integrity office
  2. The accreditation body authorized by DoD to oversee the assessment provider marketplace Correct answer.
  3. The Small Business Administration, through its mentor-protege program
  4. The contractor's own prime contractor, through a private database

Explanation

The accreditation body maintains the authoritative marketplace information about authorized C3PAOs and their scopes so contractors can select a qualified assessor. Other agencies listed do not administer the CMMC provider marketplace.

Question 25CMMC Ecosystem Overview

A contractor claims that holding an ISO/IEC 27001 certificate automatically satisfies CMMC Level 2. How should this claim be evaluated within the CMMC ecosystem?

  1. It is invalid because CMMC Level 2 certification requires assessment against the CMMC model by an authorized assessor Correct answer.
  2. It is valid because ISO 27001 and CMMC Level 2 contain identical requirements
  3. It is valid because the accreditation body accepts any internationally recognized certificate
  4. It is valid only if the ISO certificate was issued by a C3PAO

Explanation

CMMC certification is granted only through assessment against the CMMC model by an authorized provider, regardless of other certifications the contractor holds. ISO 27001 certification may reduce preparation effort but does not substitute for a CMMC assessment.

Question 26CMMC Ecosystem Overview

In the CMMC ecosystem, which organization is responsible for authorizing C3PAOs and overseeing the assessment process?

  1. The accreditation body recognized by the Department of Defense Correct answer.
  2. The prime contractor awarding the subcontract
  3. The National Institute of Standards and Technology
  4. The Defense Contract Management Agency

Explanation

The CMMC ecosystem assigns accreditation authority to a DoD-recognized accreditation body, which authorizes C3PAOs and manages assessor credentials. NIST publishes standards such as SP 800-171 but does not accredit assessors. DCMA and prime contractors play contract administration roles, not accreditation.

Question 27CMMC Ecosystem Overview

What distinguishes a Certified CMMC Assessor from a Certified CMMC Professional in the ecosystem?

  1. The assessor may lead assessment activities, while the professional supports assessment teams Correct answer.
  2. The professional holds a higher credential that replaces the assessor role
  3. The professional may certify organizations, while the assessor only prepares documentation
  4. The assessor works only for the government, while the professional works only for contractors

Explanation

The ecosystem defines a tiered assessor workforce: Certified CMMC Professionals support assessment activities under supervision, while Certified CMMC Assessors are qualified to lead assessment teams. The roles differ in authority and responsibility, not in employer type.

Question 28CMMC Ecosystem Overview

A defense contractor wants to know which organizations can conduct a Level 2 certification assessment. What should it look for?

  1. A C3PAO listed as authorized by the accreditation body Correct answer.
  2. A registered lobbyist accredited by the Department of Defense
  3. An internal audit team employed by the contractor
  4. A NIST laboratory designated for conformity testing

Explanation

Level 2 certification assessments must be performed by a C3PAO that holds current authorization from the accreditation body. Being listed as authorized confirms the organization's scope and assessor qualifications. Internal teams and NIST laboratories do not issue CMMC certifications.

Question 29CMMC Ecosystem Overview

Which statement best describes the relationship between the CMMC model and the CMMC assessment process?

  1. The model applies only to primes, while the process applies only to subcontractors
  2. The model lists authorized C3PAOs, while the process lists certified contractors
  3. The model defines required practices, while the process defines how conformance is evaluated Correct answer.
  4. The model defines assessor fees, while the process defines the security requirements

Explanation

The CMMC model is the requirements framework describing practices and maturity levels. The assessment process describes the methodology, activities, and evidence standards assessors follow. Keeping these separate clarifies what must be achieved versus how it is verified.

Question 30CMMC Ecosystem Overview

What is the primary function of the CMMC Accreditation Body in the ecosystem?

  1. To approve and oversee C3PAOs and the assessor workforce Correct answer.
  2. To adjudicate bid protests involving CMMC requirements
  3. To award defense contracts that contain CMMC clauses
  4. To write the security requirements used at each CMMC level

Explanation

The accreditation body governs the assessment market: it authorizes C3PAOs, credentials assessors, and monitors quality. The security requirements themselves originate from DoD and NIST sources. Contracting and protest functions belong to other government organizations.

Question 31CMMC Ecosystem Overview

A company provides managed security services to several defense contractors preparing for CMMC. How is such a provider best positioned in the ecosystem?

  1. As a supporting organization whose services can help contractors meet practices, without issuing certifications Correct answer.
  2. As an automatic substitute for the contractor's own compliance obligations
  3. As a government assessor that reports directly to the contracting officer
  4. As an accreditation body delegate that can certify its own clients

Explanation

Managed service providers operate as supporting organizations in the ecosystem, helping contractors implement and sustain practices. They do not hold accreditation to certify clients, and responsibility for compliance remains with the contractor. Their evidence can support an assessment but does not replace it.

Question 32CMMC Ecosystem Overview

Which artifact documents the specific assessment scope and activities that a C3PAO will perform for a contractor?

  1. The prime contractor's subcontracting plan
  2. The accreditation body's public list of authorized C3PAOs
  3. The contractor's marketing brochure describing its security posture
  4. The assessment plan agreed between the C3PAO and the contractor Correct answer.

Explanation

Before fieldwork, the C3PAO and contractor agree on an assessment plan covering scope, schedule, and methods. This plan operationalizes the assessment process for that specific engagement. Marketing materials and public listings do not define assessment scope.

Question 33CMMC Ecosystem Overview

Why does the CMMC ecosystem require C3PAOs to demonstrate independence from the contractors they assess?

  1. To limit assessments to organizations in a single geographic region
  2. To prevent contractors from hiring former government employees
  3. To ensure assessment conclusions are not influenced by consulting or financial relationships Correct answer.
  4. To guarantee that assessors charge uniform fees across all contractors

Explanation

Independence protects the credibility of certification outcomes by separating consulting from assessment. If an assessor also designed or implemented the controls, objectivity could be compromised. Fee uniformity and geographic limits are not ecosystem objectives.

Question 34CMMC Ecosystem Overview

A subcontractor receives a CMMC requirement through its prime contractor. What does the ecosystem expect regarding the flow of that requirement?

  1. The requirement is enforced by the accreditation body rather than by contract
  2. The requirement is optional for subcontractors until they win a prime contract
  3. The requirement flows down through contract clauses to subcontractors handling covered information Correct answer.
  4. The requirement applies only to the prime and stops at the first tier

Explanation

CMMC obligations reach contractors through contract clauses, and primes flow applicable requirements to subcontractors whose work involves FCI or CUI. The accreditation body authorizes assessors but does not impose contract terms. Subcontractors do not need to be primes for the requirement to apply.

Question 35CMMC Ecosystem Overview

Which description correctly characterizes the CMMC Level 1 assessment approach in the ecosystem?

  1. A continuous monitoring program run by the accreditation body
  2. An annual self-assessment with senior official affirmation Correct answer.
  3. A government-led audit performed by DCMA
  4. A triennial C3PAO certification assessment

Explanation

Level 1 relies on annual self-assessment against the basic safeguarding practices, accompanied by an affirmation from a senior official. Third-party C3PAO certification applies at Level 2. DCMA and the accreditation body do not conduct Level 1 self-assessments.

Question 36CMMC Ecosystem Overview

What does the CMMC ecosystem mean by the term 'scope' in an assessment?

  1. The list of C3PAOs authorized to operate in a state
  2. The total dollar value of defense contracts held by the contractor
  3. The assets, systems, and information flows that must be evaluated against the practices Correct answer.
  4. The number of employees assigned to the security team

Explanation

Scope defines the boundary of the assessment: which systems, people, facilities, and information flows are in play. Accurate scoping determines which practices apply and what evidence is needed. Contract value, staffing counts, and assessor listings are unrelated to this definition.

Question 37CMMC Ecosystem Overview

A contractor plans to use a cloud service provider that stores CUI. How should the contractor treat this provider within its CMMC preparation?

  1. Exclude all cloud services because they are outside the contractor's facilities
  2. Transfer all CMMC obligations to the provider permanently
  3. Include the provider's relevant services in the assessment scope and verify its security responsibilities Correct answer.
  4. Assume the provider's commercial reputation satisfies the practices

Explanation

When a provider processes or stores CUI, its relevant services fall within scope, and the contractor must confirm which practices the provider satisfies. Cloud services are not excluded merely because they are external. Responsibility for demonstrating compliance remains with the contractor.

Question 38CMMC Ecosystem Overview

Which statement describes the CMMC ecosystem's treatment of Plans of Action and Milestones during an assessment?

  1. They are optional marketing documents with no assessment relevance
  2. They document remediation for practices not yet fully met and are evaluated under process rules Correct answer.
  3. They replace the requirement to meet any practice at Level 2
  4. They are prepared by the accreditation body on the contractor's behalf

Explanation

A POA&M records known gaps, planned remediation, and timelines, and assessors evaluate it under the applicable process requirements. It does not waive the need to satisfy practices. Contractors prepare their own POA&Ms, and these documents are central to assessment outcomes.

Question 39CMMC Ecosystem Overview

What is the purpose of the CMMC certificate issued after a successful Level 2 assessment?

  1. It provides time-bound evidence that the contractor met the requirements at the time of assessment Correct answer.
  2. It certifies every subcontractor working for the contractor
  3. It replaces the need for any contract clause referencing CMMC
  4. It permanently exempts the contractor from future security obligations

Explanation

A certificate records the outcome of an assessment and remains valid for a defined period, after which reassessment is needed. It reflects the assessed scope at a point in time. It does not extend to subcontractors or remove contractual requirements.

Question 40CMMC Ecosystem Overview

How does the ecosystem handle a contractor that disputes a finding made during a C3PAO assessment?

  1. The contractor must appeal directly to the prime contractor for a ruling
  2. The contractor may ignore the finding and issue its own certificate
  3. The contractor must wait for the next scheduled assessment cycle
  4. The contractor can raise the issue through the process defined for assessment disputes and quality review Correct answer.

Explanation

The assessment process includes mechanisms for raising disagreements and for quality review of assessor decisions. These channels preserve integrity while allowing factual disputes to be resolved. Self-issued certificates and waiting for the next cycle are not valid remedies.

Question 41CMMC Ecosystem Overview

Which entity develops the security requirements that the CMMC model draws upon for protecting CUI?

  1. The prime contractors, through their subcontract terms
  2. The accreditation body, through its assessor handbook
  3. NIST, through publications such as SP 800-171 Correct answer.
  4. The C3PAOs, through consensus of their lead assessors

Explanation

The CMMC model builds on NIST SP 800-171 for CUI protection requirements. NIST develops these publications through a public standards process. The accreditation body, C3PAOs, and primes implement or flow down requirements but do not author them.

Question 42CMMC Ecosystem Overview

A contractor wants to confirm that a prospective C3PAO's authorization covers the type of assessment it needs. What is the most reliable approach?

  1. Assume all authorized C3PAOs have identical scopes
  2. Rely on the C3PAO's verbal assurance during a sales call
  3. Ask a competing contractor which assessor it used
  4. Check the accreditation body's listing for the C3PAO's authorized scope and status Correct answer.

Explanation

Authorization is scope-specific, and the accreditation body maintains listings showing each C3PAO's status and authorized activities. Verifying through that listing protects the contractor from engaging an organization outside its authorization. Verbal assurances and peer anecdotes are not reliable evidence.

Question 43CMMC Ecosystem Overview

Which statement best explains why the CMMC ecosystem separates the roles of advisor and assessor?

  1. It reduces the number of contractors eligible for certification
  2. It preserves objectivity by preventing the same organization from both implementing and certifying practices Correct answer.
  3. It ensures advisors earn higher fees than assessors
  4. It allows assessors to write the security requirements themselves

Explanation

Separating advisory work from assessment work protects the integrity of certification decisions. An organization that designed a contractor's controls could be biased when evaluating them. The separation is about objectivity, not fees, eligibility limits, or standards authorship.

Question 44CMMC Ecosystem Overview

What does the CMMC ecosystem expect a contractor to do when its assessed environment changes significantly after certification?

  1. Ask the prime contractor to amend the certificate
  2. Immediately surrender the certificate and cease defense work
  3. Take no action until the certificate's normal expiration date
  4. Notify relevant parties and address whether the change affects the validity of the certification Correct answer.

Explanation

Significant changes to scope or architecture can affect whether a certification still reflects the environment. The contractor should notify the appropriate parties and determine the impact through the defined process. Ignoring changes or unilateral actions are not appropriate responses.

Question 45CMMC Ecosystem Overview

Which term describes the DoD organization that sets CMMC policy and oversees the program's implementation across the defense industrial base?

  1. The General Services Administration
  2. The accreditation body
  3. The Office of the Under Secretary of Defense for Acquisition and Sustainment Correct answer.
  4. The Defense Industrial Base Cybersecurity Assessment Center

Explanation

CMMC policy is led within the Office of the Under Secretary of Defense for Acquisition and Sustainment, which issues program guidance. DIBCAC performs assessments for certain DoD components, and the accreditation body governs assessors. GSA handles federal acquisition services, not CMMC policy.

Question 46CMMC Ecosystem Overview

A contractor asks whether a CMMC certification obtained for one business unit can be displayed by the whole company. What is the correct ecosystem answer?

  1. The certificate can be relabeled by the contractor to name any entity
  2. The certificate covers only the CEO's personal devices
  3. The certificate automatically covers every affiliate and subsidiary worldwide
  4. The certificate applies to the assessed scope, so other units must be evaluated if they fall within scope Correct answer.

Explanation

Certification is tied to the scope assessed, including specific systems, facilities, and personnel. Business units outside that boundary are not covered and must be evaluated if they handle covered information. Certificates cannot be relabeled or extended unilaterally.

Question 47CMMC Ecosystem Overview

Which statement accurately describes the CMMC ecosystem's use of the term 'affirmation' in the assessment context?

  1. The accreditation body attests that the contractor is a small business
  2. An assessor attests that the contractor paid all fees on time
  3. A senior official attests that the assessment results and remediation plans are accurate Correct answer.
  4. A subcontractor attests that it will not handle CUI

Explanation

Affirmations are attestations by senior officials that submitted results and plans are truthful. They create accountability at the leadership level. Fee payment, subcontractor intent, and small business status are not the subject of CMMC affirmations.

Question 48CMMC Ecosystem Overview

How should a contractor interpret a C3PAO's statement that a practice is 'MET' during an assessment?

  1. The assessor found sufficient evidence that the practice's objectives were achieved Correct answer.
  2. The practice is optional at every CMMC level
  3. The contractor promised to implement the practice in a future year
  4. The practice was waived because of the contractor's size

Explanation

A MET determination means the assessor concluded, based on evidence, that the practice's objectives were satisfied. It is an evidence-based finding, not a promise or waiver. Practices are not optional where they apply to the assessed scope.

Question 49CMMC Ecosystem Overview

What is the significance of the CMMC ecosystem's requirement that assessors complete continuing professional education?

  1. It allows assessors to set their own security requirements
  2. It replaces the need for accreditation body oversight
  3. It guarantees that every assessment yields a passing result
  4. It maintains assessor competence as standards and assessment methods evolve Correct answer.

Explanation

Continuing education keeps the assessor workforce current with changing standards and methods. It supports consistent, high-quality assessments. It does not grant authority to rewrite requirements, ensure passing outcomes, or substitute for oversight.

Question 50CMMC Ecosystem Overview

A contractor's Level 2 assessment identifies several practices that are not yet met. What does the ecosystem expect next?

  1. The C3PAO rewrites the contractor's security policies
  2. The contractor is permanently barred from defense contracting
  3. The contractor receives immediate unconditional certification
  4. The contractor records the gaps with remediation plans and timelines in a POA&M Correct answer.

Explanation

Gaps are documented in a POA&M with planned remediation and timelines, which is evaluated under the applicable process rules. Certification outcomes depend on the requirements and process conditions, not automatic pass or permanent exclusion. Assessors do not perform remediation work for the contractor.