CCA free practice test

All questions and explanations

Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.

1. Question 1

   Link to question

   Which practice helps establish a common understanding of security requirements across the supply chain?

   1. Sharing standardized security policies

   2. Using unique security definitions per contractor

   3. Limiting documentation to internal teams

   4. Delaying security reviews until project completion

   Show answer and explanation

   Correct answer

   • Sharing standardized security policies

   Standardized policies provide a consistent reference that all parties can use to interpret requirements. This reduces ambiguity and aligns expectations across partners.

2. Question 2

   Link to question

   What is the primary purpose of a security assessment plan?

   1. To define scope, methods, and responsibilities for an assessment

   2. To replace the need for ongoing monitoring

   3. To serve as a marketing document for vendors

   4. To list all employees in the organization

   Show answer and explanation

   Correct answer

   • To define scope, methods, and responsibilities for an assessment

   A security assessment plan outlines how an assessment will be conducted, including objectives and roles. It ensures structured and repeatable evaluation processes.

3. Question 3

   Link to question

   Which activity is most relevant to preparing for a CMMC evaluation?

   1. Documenting security controls and their implementation

   2. Removing all legacy systems immediately

   3. Avoiding third-party risk assessments

   4. Focusing only on technical controls without policies

   Show answer and explanation

   Correct answer

   • Documenting security controls and their implementation

   CMMC evaluations require evidence that security practices are documented and operational. Clear records support objective validation during reviews.

4. Question 4

   Link to question

   Why is continuous monitoring important in a security program?

   1. It helps detect and respond to security changes over time

   2. It eliminates the need for any initial risk assessment

   3. It guarantees no security incidents will occur

   4. It reduces the importance of documented policies

   Show answer and explanation

   Correct answer

   • It eliminates the need for any initial risk assessment

   Continuous monitoring enables organizations to identify new risks and adapt controls as the environment evolves. This supports resilience against emerging threats.

5. Question 5

   Link to question

   Which of the following is a key characteristic of a strong security policy?

   1. Clearly defined responsibilities and enforcement mechanisms

   2. Lengthy text that covers every possible scenario

   3. Availability only to senior management

   4. Infrequent updates to maintain consistency

   Show answer and explanation

   Correct answer

   • Clearly defined responsibilities and enforcement mechanisms

   Effective policies specify who is responsible and how compliance is ensured. They should be accessible and periodically reviewed to remain relevant.

6. Question 6

   Link to question

   What does risk management primarily involve in a security context?

   1. Identifying, assessing, and prioritizing risks followed by coordinated treatment

   2. Eliminating all risks regardless of cost

   3. Assigning all risks to external vendors

   4. Ignoring low-probability events entirely

   Show answer and explanation

   Correct answer

   • Identifying, assessing, and prioritizing risks followed by coordinated treatment

   Risk management is a structured process that balances potential impacts against available resources. It supports informed decision-making to reduce vulnerabilities.

7. Question 7

   Link to question

   Which practice supports the principle of least privilege?

   1. Granting users only the access needed to perform their tasks

   2. Providing all users with administrative permissions

   3. Sharing common accounts across teams

   4. Allowing unrestricted access to sensitive data

   Show answer and explanation

   Correct answer

   • Granting users only the access needed to perform their tasks

   Least privilege minimizes potential damage by limiting access to what is strictly necessary. This reduces the attack surface within an environment.

8. Question 8

   Link to question

   Why is it important to define roles and responsibilities in security?

   1. To ensure accountability and clear communication during incidents

   2. To allow any team member to make all security decisions

   3. To avoid documenting security procedures

   4. To centralize all security tasks in a single role

   Show answer and explanation

   Correct answer

   • To ensure accountability and clear communication during incidents

   Clearly defined roles prevent confusion and ensure that appropriate actions are taken during normal operations and incidents. This supports coordinated response efforts.

9. Question 9

   Link to question

   Which activity helps maintain the integrity of security documentation?

   1. Controlled versioning and access management

   2. Storing documents only on personal devices

   3. Allowing unrestricted public access

   4. Updating documents only once a year

   Show answer and explanation

   Correct answer

   • Storing documents only on personal devices

   Managing access and tracking changes prevents unauthorized modifications and ensures that the documentation reflects the current state of security practices.

10. Question 10

    Link to question

    What is a common goal of security awareness training?

    1. To help personnel recognize and respond to common threats

    2. To replace technical security controls

    3. To focus exclusively on advanced technical topics

    4. To assign blame for security incidents

    Show answer and explanation

    Correct answer

    • To help personnel recognize and respond to common threats

    Awareness training builds a culture of security by helping individuals identify risks such as phishing and improper data handling. It complements technical defenses.

11. Question 11

    Link to question

    Which approach best supports compliance with security standards?

    1. Consistently applying controls and documenting evidence of implementation

    2. Implementing controls only when audits are scheduled

    3. Relying solely on verbal agreements

    4. Using different controls for each assessment without rationale

    Show answer and explanation

    Correct answer

    • Consistently applying controls and documenting evidence of implementation

    Consistent application and evidence collection demonstrate adherence to requirements. This supports both audits and continuous improvement efforts.

12. Question 12

    Link to question

    What role does incident response planning play in security?

    1. To provide a structured approach for managing and recovering from security events

    2. To eliminate the need for any preventive controls

    3. To ensure that incidents are never reported

    4. To assign all responsibility to a single individual

    Show answer and explanation

    Correct answer

    • To provide a structured approach for managing and recovering from security events

    An incident response plan defines steps to contain, analyze, and recover from incidents. It helps reduce impact and supports timely restoration of services.

13. Question 13

    Link to question

    Which practice helps ensure that security requirements are considered early in a project?

    1. Integrating security activities into the project lifecycle

    2. Adding security reviews only at the end of a project

    3. Excluding security stakeholders from planning

    4. Treating security as a separate and independent phase

    Show answer and explanation

    Correct answer

    • Integrating security activities into the project lifecycle

    Embedding security from the beginning allows issues to be identified and addressed cost-effectively. This approach reduces the likelihood of major rework later.

14. Question 14

    Link to question

    Why is it important to regularly review and update security controls?

    1. To adapt to evolving threats and changes in the environment

    2. To avoid any form of documentation

    3. To ensure controls never change over time

    4. To reduce transparency for stakeholders

    Show answer and explanation

    Correct answer

    • To avoid any form of documentation

    Regular reviews help ensure that controls remain effective as technology, processes, and risks evolve. This supports ongoing resilience and compliance.

15. Question 15

    Link to question

    Which activity is most relevant when preparing evidence for a security assessment?

    1. Collecting organized and relevant documentation

    2. Relying only on verbal explanations

    3. Providing unrelated materials from unrelated projects

    4. Delaying evidence collection until after the assessment

    Show answer and explanation

    Correct answer

    • Collecting organized and relevant documentation

    Well-organized evidence demonstrates that practices are implemented as described. It supports efficient and accurate evaluation outcomes.