Free CCP sample questions

Correct answer: 180

For a CMMC Level 2 assessment, the OSC has a maximum of 180 days from the end of the assessment to remediate any open items on their POA&M. After this period, the C3PAO will conduct a closeout assessment to verify the remediation, and if successful, recommend the OSC for certification.

Correct answer: Screenshots of the new configuration settings applied via Group Policy, combined with a report from a compliance scanning tool showing that all systems now meet the hardened baseline.

POA&M closeout requires the same level of rigor as the initial assessment. The team must verify that the control is now fully implemented. This requires objective evidence, such as examining the new configuration settings (e.g., in Group Policy) and testing their effectiveness (e.g., via a compliance scan report). This combination of 'Examine' and 'Test' evidence is sufficient to prove remediation.

Correct answer: No, because the evidence only shows intent to implement, not the actual implementation and operational use of configuration baselines.

Closing a POA&M item requires evidence that the practice is fully implemented, not just planned. A policy document and a purchase order show intent, but they do not prove that configuration baselines have been established, documented, and applied to the systems in scope. The assessment team would need to see the actual baseline configuration documents and evidence of their application (e.g., scanner results showing compliance) to mark the practice as MET.

Correct answer: False

This is false. According to the DoD Assessment Methodology, which informs the CMMC process, certain high-weighted practices cannot be on a POA&M for a conditional certification to be granted. The practice for maintaining a System Security Plan (SSP) is one of these critical, high-weighted requirements. Failure to have an SSP is a fundamental deficiency, and therefore the OSC cannot achieve certification with this practice on a POA&M.

Correct answer: 180 days

According to the CMMC Assessment Process (CAP), an OSC that undergoes an assessment and has remaining POA&M items has a maximum of 180 days from the end of the assessment to complete remediation and have the items successfully closed out by the C3PAO.

Correct answer: Collecting and evaluating objective evidence specifically for the POA&M items to confirm they have been fully remediated and now meet the CMMC practice requirements.

The POA&M closeout assessment is tightly focused. Its purpose is not a full reassessment but to specifically verify that the deficiencies documented in the POA&M have been corrected. The CCP's role is to assist in collecting and analyzing new evidence for only those 'NOT MET' practices to determine if they now score as 'MET'.

Correct answer: The relationship creates a potential conflict of interest that could compromise the C3PAO's objectivity.

The CMMC ecosystem is built on the principle of objectivity and independence, especially for assessment bodies. A C3PAO must be impartial. An RPO recommending a specific C3PAO due to a "close working relationship" creates a potential or actual conflict of interest, which is a serious ethical violation. This could imply a quid-pro-quo arrangement or suggest that the assessment may not be entirely objective.

Correct answer: To develop, maintain, and sell CMMC-AB approved training curriculum to Licensed Training Providers (LTPs).

Licensed Partner Publishers (LPPs) are authorized by the CMMC-AB to create and manage the official curriculum and training materials. They license this content to Licensed Training Providers (LTPs), who then use it to deliver training to CCP candidates and other CMMC professionals. LPPs focus on content creation, while LTPs focus on content delivery.

Correct answer: Immediately disclose the potential conflict of interest to the Lead Assessor and the C3PAO.

The CMMC-AB Code of Professional Conduct requires professionals to avoid both actual and perceived conflicts of interest. Having previously designed the systems under assessment compromises the CCP's objectivity. The correct and ethical action is to immediately disclose this to the Lead Assessor and the C3PAO so they can determine the appropriate course of action, which may include removing the CCP from the assessment.

Correct answer: False

This is false. The CMMC-AB Code of Professional Conduct emphasizes strict confidentiality. The C3PAO has a contractual obligation with the OSC. While the final certification level is reported to the DoD, the detailed findings, evidence, and specific vulnerabilities are confidential information belonging to the OSC. Sharing this information without consent would be a breach of confidentiality unless required by law or a court order.