Free CCA sample questions

Correct answer: CUI is information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies, whereas FCI is information not intended for public release that is provided by or generated for the Government under a contract.

CUI requires stringent protection controls defined by NIST SP 800-171 (CMMC Level 2), as it involves specific safeguarding laws or regulations. FCI only requires the 15 basic safeguarding requirements outlined in FAR 52.204-21 (CMMC Level 1). Understanding this distinction is the first step in determining an OSC's readiness and applicability for a Level 2 assessment.

Correct answer: False

False. A finalized, formally documented System Security Plan (SSP) is a fundamental prerequisite for any CMMC Level 2 assessment. The SSP describes the system boundary and how the security requirements are met. Without a finalized SSP, the assessor cannot establish the assessment scope or evaluate the baseline controls, making the OSC unready for an assessment.

Correct answer: Within 72 hours of discovery

DFARS 252.204-7012 strictly mandates that defense contractors must rapidly report cyber incidents to the DoD (via DIBNet) within 72 hours of discovery. Assessing an OSC's incident response capability during a CMMC Level 2 assessment involves verifying that this 72-hour reporting mechanism is formally established and tested.

Correct answers: System Security Plan (SSP); Plan of Action and Milestones (POA&M)

The System Security Plan (SSP) is the foundational document that defines the assessment boundary and describes how the NIST SP 800-171 practices are implemented. Without it, the assessment cannot begin.

The Plan of Action and Milestones (POA&M) is required to document any unmet or planned security requirements. Even if no items are currently deficient, a formal POA&M process must exist and be provided to the assessment team.

Correct answer: The use of a Commercial SaaS Application to store/process CUI without demonstrating FedRAMP Moderate equivalency.

Under DFARS 252.204-7012 and CMMC Level 2 requirements, any Cloud Service Provider (CSP) used to store, process, or transmit CUI must meet security requirements equivalent to FedRAMP Moderate baseline. Using a standard commercial SaaS application without establishing this equivalency is a critical compliance failure and a major readiness risk.

Correct answer: CMMC Level 2; applied only to the enclave or systems that process, store, or transmit the CUI associated with Subcontract B, plus any Security Protection Assets.

Because Subcontract B involves CUI and DFARS 7012, the organization must achieve CMMC Level 2. However, this requirement only applies to the systems within the assessment boundary (the CUI enclave) that process, store, or transmit that CUI, along with the Security Protection Assets that secure them. COTS contracts (Subcontract C) do not inherently require CMMC, and FAR 52.204-21 (Subcontract A) only requires Level 1 for those specific systems.