Free CMMC-CCP Practice Test Questions 2026

During a CMMC readiness review, the OSC proposes that an associated enclave should not be applicable in the scope. Who is responsible for verifying this request?

A. CCP

B. C3PAO

C. Lead Assessor

D. Advisory Board

Which CMMC Levels focus on protecting CUI from exfiltration?

A. Levels 1 and 2

B. Levels 1 and 3

C. Levels 2 and 3

D. Levels 1, 2, and 3

What is the BEST description of the purpose of FAR clause 52 204-21?

A. It directs all covered contractors to install the cyber security systems listed in that clause.

B. It describes all of the safeguards that contractors must take to secure covered contractor IS.

C. It describes the minimum standard of care that contractors must take to secure covered contractor IS.

D. It directs covered contractors to obtain CMMC Certification at the level equal to the lowest requirement of their contracts.

The practices in CMMC Level 2 consist of the security requirements specified in:

A. NIST SP 800-53

B. NIST SP 800-171

C. 48 CFR 52.204-21

D. DFARS 252.204-7012

Which domains are a part of a Level 1 Self-Assessment?

A. Access Control (AC), Risk Management

B. Risk Management (RM). Access Control (AC), and Physical Protection (PE)

C. Access Control (AC), Physical Protection (PE), and Identification and Authentication (IA)

D. Risk Management (RM). Media Protection (MP), and Identification and Authentication (IA)

Prior to conducting a CMMC Assessment, the contractor must specify the CMMC Assessment scope by categorizing all assets. Which two asset categories are always assessed against CMMC practices?

A. CUI Assets and Specialized Assets

B. Security Protection Assets and CUI Assets

C. Specialized Assets and Contractor Risk Managed Assets

D. Security Protection Assets and Contractor Risk Managed Assets

Which standard and regulation requirements are the CMMC Model 2.0 based on?

A. NIST SP 800-171 and NIST SP 800-172

B. DFARS, FIPS 100, and NIST SP 800-171

C. DFARS, NIST, and Carnegie Mellon University

D. DFARS, FIPS 100, NIST SP 800-171, and Carnegie Mellon University

An assessment is being conducted at a remote client site. For the duration of the assessment, the client has provided a designated hoteling space in their secure facility which consists of a desk with access to a shared printer. After noticing that the desk does not lock, a locked cabinet is requested but the client does not have one available. At the end of the day, the client provides a printout copy of an important network diagram. The diagram is clearly marked and contains CUI. What should be done NEXT to protect the document?

A. Take it with them to review in the evening.

B. Leave it on the desk for review the following day.

C. Put it in the unlocked desk drawer for review the following morning.

D. Take a picture with the personal phone before securely shredding it.

An assessor is collecting affirmations. So far, the assessor has collected interviews, demonstrations, emails, messaging, and presentations. Are these appropriate approaches to collecting affirmations?

A. No, emails are not appropriate affirmations.

B. No, messaging is not an appropriate affirmation.

C. Yes, the affirmations collected by the assessor are all appropriate.

D. Yes, the affirmations collected by the assessor are all appropriate, as are screenshots.

In preparation for a CMMC Level 1 Self-Assessment, the IT manager for a DIB organization is documenting asset types in the company's SSP The manager determines that identified machine controllers and assembly machines should be documented as Specialized Assets. Which type of Specialized Assets has the manager identified and documented?

A. loT

B. Restricted IS

C. Test equipment

D. Operational technology

During the planning phase of a CMMC Level 2 Assessment, the Lead Assessor is considering what would constitute the right evidence for each practice. What is the Assessor attempting to verify?

A. Adequacy

B. Sufficiency

C. Process mapping

D. Assessment scope

According to the Configuration Management (CM) domain, which principle is the basis for defining essential system capabilities?

A. Least privilege

B. Essential concern

C. Least functionality

D. Separation of duties