Free CCP sample questions

Correct answer: The deficient practice must not be one of the highest-weighted practices as defined by the DoD Assessment Methodology.

Under the CMMC Assessment Process and the associated DoD Assessment Methodology, not all practices are weighted equally. Certain critical practices are assigned higher point values (e.g., 5 points). A deficiency in one of these highest-weighted practices cannot be placed on a POA&M; it must be fully MET for certification. Only lower-weighted practices are eligible for a POA&M, and there is a cap on the total number of deficiencies allowed.

Correct answer: The POA&M item cannot be closed because the practice requires security controls to be assessed, not just planned. The lack of an actual assessment being conducted means the practice is not yet implemented.

Closing a POA&M item requires sufficient evidence that the underlying practice is fully implemented and 'MET'. Practice CA.L2-3.12.4 requires that security controls are periodically assessed. Simply having a policy and a future schedule is not enough; it only shows planning. To close the POA&M, the OSC would need to provide evidence that at least one internal assessment has actually been conducted and its results documented, demonstrating the process is operational.

Correct answer: 180

For a CMMC Level 2 assessment, the OSC has a maximum of 180 days from the end of the assessment to remediate any open items on their POA&M. After this period, the C3PAO will conduct a closeout assessment to verify the remediation, and if successful, recommend the OSC for certification.

Correct answer: Screenshots of the new configuration settings applied via Group Policy, combined with a report from a compliance scanning tool showing that all systems now meet the hardened baseline.

POA&M closeout requires the same level of rigor as the initial assessment. The team must verify that the control is now fully implemented. This requires objective evidence, such as examining the new configuration settings (e.g., in Group Policy) and testing their effectiveness (e.g., via a compliance scan report). This combination of 'Examine' and 'Test' evidence is sufficient to prove remediation.

Correct answer: No, because the evidence only shows intent to implement, not the actual implementation and operational use of configuration baselines.

Closing a POA&M item requires evidence that the practice is fully implemented, not just planned. A policy document and a purchase order show intent, but they do not prove that configuration baselines have been established, documented, and applied to the systems in scope. The assessment team would need to see the actual baseline configuration documents and evidence of their application (e.g., scanner results showing compliance) to mark the practice as MET.

Correct answer: False

This is false. According to the DoD Assessment Methodology, which informs the CMMC process, certain high-weighted practices cannot be on a POA&M for a conditional certification to be granted. The practice for maintaining a System Security Plan (SSP) is one of these critical, high-weighted requirements. Failure to have an SSP is a fundamental deficiency, and therefore the OSC cannot achieve certification with this practice on a POA&M.

Correct answer: 180 days

According to the CMMC Assessment Process (CAP), an OSC that undergoes an assessment and has remaining POA&M items has a maximum of 180 days from the end of the assessment to complete remediation and have the items successfully closed out by the C3PAO.

Correct answer: Collecting and evaluating objective evidence specifically for the POA&M items to confirm they have been fully remediated and now meet the CMMC practice requirements.

The POA&M closeout assessment is tightly focused. Its purpose is not a full reassessment but to specifically verify that the deficiencies documented in the POA&M have been corrected. The CCP's role is to assist in collecting and analyzing new evidence for only those 'NOT MET' practices to determine if they now score as 'MET'.

Correct answer: The relationship creates a potential conflict of interest that could compromise the C3PAO's objectivity.

The CMMC ecosystem is built on the principle of objectivity and independence, especially for assessment bodies. A C3PAO must be impartial. An RPO recommending a specific C3PAO due to a "close working relationship" creates a potential or actual conflict of interest, which is a serious ethical violation. This could imply a quid-pro-quo arrangement or suggest that the assessment may not be entirely objective.

Correct answer: To develop, maintain, and sell CMMC-AB approved training curriculum to Licensed Training Providers (LTPs).

Licensed Partner Publishers (LPPs) are authorized by the CMMC-AB to create and manage the official curriculum and training materials. They license this content to Licensed Training Providers (LTPs), who then use it to deliver training to CCP candidates and other CMMC professionals. LPPs focus on content creation, while LTPs focus on content delivery.