CCP Practice Test

CCP Practice Test practice questions, page 6 of 7, with answer review and explanations.

Question 26

Which code or clause requires that a contractor is meeting the basic safeguarding requirements for FCI during a Level 1 Self-Assessment?

  1. FAR 52.204-21
  2. 22 CFR 120-130
  3. DFARS 252.204-7011
  4. DFARS 252.204-7021

Question 27

How does the CMMC define a practice?

  1. A business transaction
  2. A condition arrived at by experience or exercise
  3. A series of changes taking place in a defined manner
  4. An activity or activities performed to meet defined CMMC objectives

Question 28

The Lead Assessor interviews a network security specialist of an OSC. The incident monitoring report for the month shows that no security incidents were reported from OSC’s external SOC service provider. This is provided as evidence for RA.L2-3.11.2: Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified. Based on this information, the Lead Assessor should conclude that the evidence is:

  1. inadequate because it is irrelevant to the practice.
  2. adequate because it fits well for expected artifacts.
  3. adequate because no security incidents were reported.
  4. inadequate because the OSC’s service provider should be interviewed.

Question 29

While determining the scope for a company’s CMMC Level 1 Self-Assessment, the contract administrator includes the hosting providers that manage their IT infrastructure. Which asset type BEST describes the third-party organization?

  1. ESPs
  2. People
  3. Facilities
  4. Technology

Question 30

When are contractors required to achieve a CMMC certificate at the Level specified in the solicitation?

  1. At the time of award
  2. Upon solicitation submission
  3. Thirty days from the award date
  4. Before the due date of submission