Apply the Appropriate CMMC Source Documents to Evaluate CMMC Practice Implementation (minimum Coverage of Level 1 Practices) CCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which CMMC Level 1 practice is directly derived from NIST SP 800-171 control 3.1.1, which requires limiting system access to authorized users?

   • ACA.L1-3.12.1
   • BSC.L1-3.13.1
   • CAC.L1-3.1.1
   • DIA.L1-3.5.1
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A contractor that only handles FCI (not CUI) is preparing for a CMMC Level 1 assessment. The contractor has implemented all 17 practices, but the assessor notes that the contractor does not have any CUI. How does this affect the Level 1 compliance determination?

   • AThe contractor is not eligible for Level 1 certification because they do not handle CUI.
   • BThe contractor can still achieve Level 1 certification if all practices are implemented.
   • CThe contractor must wait until they handle CUI to be assessed.
   • DThe contractor must implement additional practices to protect FCI.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An assessor is preparing for a CMMC Level 1 assessment and needs to know which document contains the specific practices that will be assessed. Which document should the assessor use?

   • AThe CMMC Assessment Guide.
   • BThe NIST SP 800-171 document.
   • CThe CMMC Level 1 Practices document.
   • DThe CMMC Model Overview document.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When evaluating whether an organization has implemented CMMC Level 1 practice IA.L1-3.5.1 (identify system users and authenticate them), which combination of evidence would an assessor consider sufficient?

   • AA list of all system users and their email addresses
   • BA written policy requiring unique user IDs and a system configuration that enforces password-based authentication
   • CA training log showing employees completed a security awareness course
   • DA firewall configuration that blocks external access
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   During a CMMC Level 1 assessment, which source document would an assessor use to understand the intent and assessment objectives for a specific practice?

   • ACMMC Level 1 Practices
   • BCMMC Assessment Guide
   • CCMMC Scoping Guide
   • DCMMC Model Overview
   Reveal Solution Discussion Select an answer first