Cyber AB CMMC-CCP Exam Questions

CMMC Level 2 Assessment MethodsCMMC Level 2 assessments focus on verifying compliance withNIST SP 800-171 requirements. TheCMMC Assessment Process (CAP) Documentspecifies that assessments at this level include:

Examination-- Reviewing documents, mechanisms, and activities.

Interview-- Speaking with personnel to validate implementation.

Testing-- Observing and verifying security controls in action.

What Does 'Examination' Include?According toCMMC Assessment Methodology, examination involves reviewing:

Documents(Policies, procedures, security plans)

Mechanisms(Security controls, authentication systems)

Activities(Backup operations, network monitoring, security training)

Sinceexamination includes reviewing documents, mechanisms, and activities, the correct answer isA.

B . Specific hardware, software, or firmware safeguards employed within a system.Incorrect. While safeguardsmaybe examined, CMMC does not limit examination to only hardware, software, or firmware. The definition is broader.

C . Policies, procedures, security plans, penetration tests, and security requirements.Incorrect. Whilesome of these itemsare examined, penetration tests arenot requiredin a CMMC Level 2 assessment.

D . Observation of system backup operations, exercising a contingency plan, and monitoring network traffic.Incorrect. These activities fall undertesting and interviews, not just examination.

Why the Other Answers Are Incorrect

CMMC Assessment Process (CAP) Document-- Defines 'examination' as reviewingdocuments, mechanisms, and activities.

CMMC Official ReferenceThus,option A (documents, mechanisms, or activities) is the correct answer, as it aligns with CMMC Level 2 assessment methodology.

Understanding Access Control (AC) in CMMC Advanced (Level 3)TheCMMC Advanced Level (Level 3)is designed for organizations handlinghigh-value Controlled Unclassified Information (CUI)and aligns with a subset ofNIST SP 800-172for advanced cybersecurity protections.

Access Control (AC) Practices in CMMC Level 3CMMC Level 1 includesbasic AC practices fromFAR 52.204-21(e.g., restricting access to authorized users).

CMMC Level 2 includesallAccess Control (AC) practices from NIST SP 800-171(e.g., managing privileged access).

CMMC Level 3 expands on Levels 1 and 2, incorporatingadditional protections from NIST SP 800-172, such as enhanced monitoring and adversary deception techniques.

CMMC Level 3 builds upon all previous levels, includingAccess Control (AC) practices from Levels 1 and 2.

Options A, B, and C are incorrectbecause Level 3 includesallprevious AC practices fromLevels 1 and 2, plus additional ones.

Why 'Levels 1, 2, and 3' is Correct?Breakdown of Answer ChoicesOption

Description

Correct?

A . Level 1

Incorrect--Level 3 includes AC practices fromLevels 1 and 2, not just Level 1.

B . Level 3

Incorrect -- Level 3 builds onLevels 1 and 2, not just Level 3 practices.

C . Levels 1 and 2

Incorrect--Level 3 containsadditionalAC practices beyond Levels 1 and 2.

D . Levels 1, 2, and 3

Correct -- Level 3 contains all AC practices from Levels 1 and 2, plus additional ones.

CMMC Model Framework-- Outlines howLevel 3 builds upon Level 1 and 2 practices.

NIST SP 800-172-- Definesadvanced cybersecurity controlsrequired inCMMC Level 3.

Official Reference from CMMC 2.0 DocumentationFinal Verification and ConclusionThe correct answer isD. Levels 1, 2, and 3, as CMMC Level 3 includesAccess Control (AC) practices from all previous levels plus additional enhancements.

Understanding Asset Types in CMMC 2.0In CMMC 2.0, assets are categorized based on their role in handlingFederal Contract Information (FCI)orControlled Unclassified Information (CUI). TheCybersecurity Maturity Model Certification (CMMC) Scoping GuidanceforLevel 1andLevel 2provides asset definitions to help organizations identify what needs protection.

According toCMMC Scoping Guidance, there are five primary asset types:

Security Protection Assets (ESP - External Service Providers & Security Systems)

People (Personnel who interact with FCI/CUI)

Facilities (Physical locations housing FCI/CUI)

Technology (Hardware, software, and networks that store, process, or transmit FCI/CUI)

CUI Assets (For Level 2 assessments, assets specifically storing CUI)

Why 'Technology' Is the Correct AnswerThe IT manager is evaluatingservers, laptops, databases, and applications---all of which aretechnology assetsused to store, process, or transmit FCI.

According toCMMC Scoping Guidance,Technology assetsinclude:

Endpoints(Laptops, Workstations, Mobile Devices)

Servers(On-premise or cloud-based)

Networking Devices(Routers, Firewalls, Switches)

Applications(Software, Cloud-based tools)

Databases(Storage of FCI or CUI)

Since the IT manager is focusing on these components, the correct asset category isTechnology (Option D).

A . ESP (Security Protection Assets)Incorrect. ESPs refer tosecurity-related assets(e.g., firewalls, monitoring tools, managed security services) thathelp protectFCI/CUI but do notstore, process, or transmitit directly.

B . PeopleIncorrect. While employees play a role in handling FCI, the question focuses onhardware and software---which falls underTechnology, not People.

C . FacilitiesIncorrect. Facilities refer tophysical buildingsor secured areas where FCI/CUI is stored or processed. The question explicitly mentionsservers, laptops, and applications, which arenot physical facilities.

Why the Other Answers Are Incorrect

CMMC Level 1 Scoping Guide (CMMC-AB)-- Defines asset categories, including Technology.

CMMC 2.0 Scoping Guidance for Assessors-- Provides clarification on FCI assets.

CMMC Official ReferenceThus,option D (Technology) is the most correct choiceas per official CMMC 2.0 guidance.

Understanding the Role of CAICO in the CMMC EcosystemTheCMMC Ecosystemconsists of multiple organizations that manage, implement, and oversee different aspects of theCybersecurity Maturity Model Certification (CMMC)program.

One of the key organizations is theCMMC Assessors and Instructors Certification Organization (CAICO), which is responsible for:

Training and certifying assessors and instructors.

Managing testing, authorization, and certificationfor CMMC professionals.

Ensuring assessors meet qualification and compliance standards.

TheCAICO is explicitly taskedwith thetraining, testing, authorization, and certification of candidate assessors and instructors.

Option A (DoD OUSD)is incorrect because theDoD Office of the Under Secretary of Defense(OUSD) provides policy oversight butdoes not handle certification of assessors.

Option B (DIB Collaborative Information Sharing Environment)is incorrect because theDIB CISfocuses on information sharing within the Defense Industrial Base, not assessor certification.

Option C (Committee on National Security Systems Instructions)is incorrect because CNSSI provides security standards butdoes not manage assessor training or certification.

CMMC Ecosystem Overview -- Role of the CAICO

CMMC Assessment Process (CAP) Guide -- Assessor Certification and Training

Why Option D (CAICO) is CorrectOfficial CMMC Documentation ReferenceFinal VerificationSinceCAICO is responsible for training, testing, and certifying CMMC assessors and instructors, the correct answer isOption D: CMMC Assessors and Instructors Certification Organization.

CMMC 2.0 Level 2 is directly aligned withNIST Special Publication (SP) 800-171, 'Protecting Controlled Unclassified Information (CUI) in Nonfederal Systems and Organizations.'Organizations seeking certification (OSC) at Level 2 must demonstrate compliance with the 110 security requirements specified inNIST SP 800-171, as mandated byDFARS 252.204-7012.

Defines the Security Requirements for Protecting CUI:

NIST SP 800-171 outlines 110 security controls that contractors must implement to protectControlled Unclassified Information (CUI)in nonfederal systems.

These controls are categorized under14 families, including access control, incident response, and risk management.

Establishes the Baseline for CMMC Level 2 Compliance:

CMMC 2.0 Level 2 assessments areentirely based on NIST SP 800-171requirements.

Every practice assessed in a Level 2 certification maps directly to a requirement fromNIST SP 800-171 Rev. 2.

Provides Guidance for Implementation & Assessment:

TheNIST SP 800-171A 'Assessment Guide'provides detailed assessment objectives that guide OSCs in preparing for CMMC evaluations.

It helps define the scope of an assessment by clarifying how each control should be implemented and verified.

Referenced in CMMC and DFARS Regulations:

DFARS 252.204-7012requires contractors to implementNIST SP 800-171security requirements.

TheCMMC 2.0 Level 2modeldirectly incorporates all 110 requirementsfromNIST SP 800-171, ensuring consistency with DoD cybersecurity expectations.

A . NIST SP 800-53 ('Security and Privacy Controls for Federal Information Systems and Organizations')

This documentapplies to federal systems, not nonfederal entities handling CUI.

While it is the foundation for other security standards, it isnot the basis of CMMC Level 2assessments.

B . NIST SP 800-88 ('Guidelines for Media Sanitization')

This documentfocuses on secure data destructionand media sanitization techniques.

While data disposal is important, this standarddoes not define security controls for protecting CUI.

D . NIST SP 800-172 ('Enhanced Security Requirements for Protecting CUI')

This documentbuilds on NIST SP 800-171and applies to systems needingadvanced cybersecurity protections(e.g., targeting Advanced Persistent Threats).

It isnot required for standard CMMC Level 2 assessments, which only mandateNIST SP 800-171 compliance.

NIST SP 800-171 Rev. 2(NIST Official Site)

NIST SP 800-171A (Assessment Guide)(NIST Official Site)

CMMC 2.0 Level 2 Scoping Guide(Cyber AB)

Why NIST SP 800-171 is Essential for Level 2 Scoping:Explanation of Incorrect Answers:Key Reference for CMMC Level 2 Scoping:Conclusion:SinceCMMC 2.0 Level 2 assessments are based entirely on NIST SP 800-171, this document is the most relevant resource for scoping Level 2 assessments. Therefore, the correct answer is:

C. NIST SP 800-171