Demonstrate Understanding of the CMMC Source and Supplementary Documents CCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of the CMMC Assessment Guide in relation to the CMMC Model Overview?

   • ATo replace the Model Overview with updated requirements
   • BTo provide security requirements for CUI protection
   • CTo define the levels and domains of the CMMC model
   • DTo provide detailed procedures for assessing compliance with the model's requirements
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which document is a supplementary source that provides the security requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems?

   • ACMMC Assessment Guide
   • BNIST SP 800-171
   • CDFARS Clause 252.204-7012
   • DCMMC Model Overview
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is preparing its documentation for a CMMC assessment scheduled in six months. The team has been using a version of NIST SP 800-171 that is several years old. What is the most important reason to verify they are using the current version of this supplementary document?

   • ATo confirm the CMMC assessment level they are targeting is still valid.
   • BTo ensure the company's legal contract with the DoD is updated.
   • CTo ensure their implemented practices align with the latest security requirements and assessment expectations.
   • DTo ensure their System Security Plan (SSP) is formatted correctly for the assessor.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How do supplementary documents like NIST SP 800-171 support CMMC implementation?

   • ABy defining the CMMC levels and domains
   • BBy providing assessment procedures for CMMC assessments
   • CBy establishing the legal requirements for CMMC compliance
   • DBy providing the security requirements that CMMC practices are based on
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization is mapping its current security controls to CMMC Level 2 practices. The team notices that a specific CMMC practice is derived from a security requirement in NIST SP 800-171. What is the primary role of NIST SP 800-171 in this context?

   • AIt provides the specific assessment methods and evidence required for CMMC certification.
   • BIt provides the legal authority for the CMMC program.
   • CIt serves as the source document that defines the underlying security requirements for CUI.
   • DIt defines the CMMC levels and the maturity processes for each level.
   Reveal Solution Discussion Select an answer first