Free PECB CMMC Foundations exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB CMMC Foundations exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which CMMC Code of Professional Conduct principle addresses avoiding conflicts of interest and making unbiased decisions?

   1. A.Professionalism
   2. B.ImpartialityCorrect answer: B
   3. C.Confidentiality
   4. D.Information integrity

   Explanation: The code defines "Impartiality: avoiding conflicts of interest and maintaining unbiased decision-making." The other principles address professional behavior, protection of sensitive information, or information accuracy and security.

   Reference: CMMC Code of Professional Conduct — Article II, Guiding Principles, p. 5

2. 2A contractor is applying FAR 52.204-21 to a covered system. An employee has a valid account but is authorized only to read contract records. Which access restriction addresses the employee's permitted actions?

   1. A.Limit the account to the transactions and functions it is authorized to execute.Correct answer: A
   2. B.Permit all transactions once the account has been identified.
   3. C.Replace the account with a shared account having broader privileges.
   4. D.Restrict only physical entry while allowing all system functions.

   Explanation: The clause requires contractors to "Limit information system access to the types of transactions and functions that authorized users are permitted to execute." A valid account alone does not authorize every function.

   Reference: FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems — FAR 52.204-21(b)(1)(ii)

3. 3A CMMC practitioner completes an engagement involving a client's confidential material. How should the practitioner treat that material after the work ends?

   1. A.Protect its confidentiality after the engagement ends.Correct answer: A
   2. B.Release it once the engagement has formally ended.
   3. C.Share it with any other practitioner in the ecosystem.
   4. D.Publish it when the client has not marked it classified.

   Explanation: The code requires "Exercising due care to ensure that confidential or privileged information gathered during CMMC assessments or consulting engagements remains so, even after the work has ended." Ending the engagement, ecosystem membership, or the absence of a classified marking does not authorize disclosure.

   Reference: CMMC Code of Professional Conduct — Article II, § 2.3(b), p. 7

4. 4A covered contractor system receives a connection request from another organization's information system. What does FAR 52.204-21 require concerning this external connection?

   1. A.Verify and control or limit the connection and use.Correct answer: A
   2. B.Permit the connection whenever the external system is operating.
   3. C.Treat all external systems as authorized users automatically.
   4. D.Record the connection only after it has transferred FCI.

   Explanation: The clause requires contractors to "Verify and control/limit connections to and use of external information systems." An operating system or a completed transfer is not a substitute for verification and control.

   Reference: FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems — FAR 52.204-21(b)(1)(iii)

5. 5During an active CMMC certification assessment, what does the professional conduct code say about soliciting future consulting business from the assessment client?

   1. A.It is appropriate if the consultation is offered at a discount.
   2. B.It is appropriate if a different assessor makes the offer.
   3. C.It should be avoided during the active assessment.Correct answer: C
   4. D.It is appropriate if the client initiates the consulting discussion.

   Explanation: The code calls for "Refraining from soliciting business or engaging in discussions about future consulting engagements with clients during active certification assessments." A discount, another assessor, or client initiation does not remove that restriction.

   Reference: CMMC Code of Professional Conduct — Article II, § 2.2(g), p. 7

6. 6A contractor plans to release a storage device containing FCI for reuse. Which action addresses the applicable FAR basic safeguarding requirement?

   1. A.Sanitize or destroy the media before releasing it for reuse.Correct answer: A
   2. B.Remove its inventory label but retain the FCI on the device.
   3. C.Transfer the device to a new user with the existing data intact.
   4. D.Delete the file names while leaving the FCI on the media.

   Explanation: The clause requires contractors to "Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse." Relabeling, transferring intact data, or deleting filenames without removing the FCI does not sanitize the media.

   Reference: FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems — FAR 52.204-21(b)(1)(vii)

7. 7Under the CMMC Code of Professional Conduct, which behavior best supports information integrity when reporting Level 2 certification assessment results?

   1. A.Report results objectively, completely, clearly, and accurately.Correct answer: A
   2. B.Report only results that support the client's desired status.
   3. C.Report preliminary findings as final before they are reviewed.
   4. D.Report results using estimates where evidence is incomplete.

   Explanation: The code specifies "Reporting results and data from Level 2 certification assessments and training objectively, completely, clearly, and accurately." Selective reporting, treating preliminary results as final, and substituting estimates for evidence undermine that standard.

   Reference: CMMC Code of Professional Conduct — Article II, § 2.4(b), p. 8

8. 8A visitor enters a covered contractor's controlled operating area. Which combination addresses the FAR physical access safeguards for visitors?

   1. A.Escort the visitor and monitor the visitor's activity.Correct answer: A
   2. B.Allow unescorted access after the visitor states a purpose.
   3. C.Permit entry based solely on an existing network account.
   4. D.Monitor the visitor only after access has ended.

   Explanation: The clause requires contractors to "Escort visitors and monitor visitor activity". A stated purpose or network account does not replace escort and monitoring.

   Reference: FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems — FAR 52.204-21(b)(1)(ix)

9. 9What does the CMMC Code of Professional Conduct say about representing a practitioner's credentials and authorized services?

   1. A.Claim authority to provide services that are not authorized.
   2. B.Represent credentials and authorized capabilities accurately.Correct answer: B
   3. C.Emphasize intended future credentials as though already earned.
   4. D.Present an expired credential as currently valid.

   Explanation: The professionalism practices include "Representing oneself and one’s organization accurately and completely" and expressly prohibit misrepresenting credentials or exaggerating authorized capabilities. Aspirational credentials and broad claims cannot be presented as current authorization.

   Reference: CMMC Code of Professional Conduct — Article II, § 2.1(a), pp. 5–6

10. 10A covered contractor places a publicly accessible system component on a subnetwork. How should that subnetwork relate to internal networks under FAR 52.204-21?

    1. A.It should be physically or logically separated from internal networks.Correct answer: A
    2. B.It should have unrestricted direct access to every internal system.
    3. C.It should share an unsegmented network with internal components.
    4. D.It should be separated only from other public components.

    Explanation: The clause requires "subnetworks for publicly accessible system components that are physically or logically separated from internal networks." The provision addresses separation of the public components from internal networks.

    Reference: FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems — FAR 52.204-21(b)(1)(xi)