Given a Scenario, Apply the Appropriate Phases and Steps to Plan, Prepare, Conduct, and Report on a CMMC Level 2 Assessment CCA Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is a key part of preparing for a CMMC Level 2 assessment?

   • ADefining roles and responsibilities for the assessment team
   • BCollecting evidence by testing security controls
   • CDetermining the assessment scope
   • DCompiling findings into a final report
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An assessor has completed a CMMC Level 2 assessment and is preparing the final report. The organization's management disagrees with a finding and asks the assessor to remove it from the report. What should the assessor do?

   • AKeep the finding and explain the evidence and rationale to the organization.
   • BRemove the finding to maintain a good relationship with the organization.
   • CRefer the matter to the organization's legal counsel.
   • DModify the finding to be less severe to appease the organization.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During a CMMC Level 2 assessment, the assessor needs to verify that access control policies are implemented. The assessor reviews the written policy, interviews the system administrator, and attempts to log in with a test account to see if access is restricted. Which assessment methods are being used?

   • AExamine, interview, and test
   • BExamine and test only
   • CExamine and interview only
   • DInterview and test only
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During the conduct phase of a CMMC Level 2 assessment, what is the primary purpose of using the 'test' method?

   • ATo ask questions of personnel
   • BTo review documentation for completeness
   • CTo verify that a security control operates as intended
   • DTo plan the assessment schedule
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   During the planning phase of a CMMC Level 2 assessment, which of the following is a primary input that the assessor must obtain from the organization being assessed?

   • AThe assessor's own training certificates
   • BThe organization's system security plan (SSP) and asset inventory
   • CThe organization's marketing and sales materials
   • DThe final assessment report from the previous year
   Reveal Solution Discussion Select an answer first