Given a Scenario, Apply the Appropriate Phases and Steps to Plan, Prepare, Conduct, and Report on a CMMC Level 2 Assessment CCA Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An assessor is conducting a CMMC Level 2 assessment and needs to verify that the organization's access control policy is enforced. The assessor has reviewed the policy document and interviewed the system administrator. The administrator claims that the policy is enforced, but the assessor wants to confirm. Which additional action would provide the strongest evidence?

   • AReviewing the system's audit logs to see if access attempts are logged.
   • BAttempting to access a restricted resource with a test account.
   • CInterviewing another administrator to confirm the policy is enforced.
   • DReviewing the organization's training records to see if employees were trained on the policy.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An assessor is preparing for a CMMC Level 2 assessment and needs to ensure effective communication with the organization. Which action is most appropriate during the preparation phase?

   • ADrafting the final assessment report.
   • BConducting a preliminary test of the organization's security controls.
   • CDetermining the overall compliance status.
   • DEstablishing a secure channel for sharing assessment documents and evidence.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A C3PAO is assessing a defense contractor that has a complex IT environment, including on-premises servers and a cloud-based collaboration tool. The contractor has provided the SSP and network diagrams. During the planning phase, the assessor identifies that the cloud service provider's shared responsibility model is not clearly documented. The contractor's IT director insists that the cloud provider is responsible for all security controls. The assessor needs to proceed with the assessment. What is the most appropriate action?

   • ARefuse to assess the cloud environment because the contractor does not own the infrastructure.
   • BProceed directly to the conduct phase and test the cloud provider's controls.
   • CAccept the IT director's assertion and assess only the on-premises components.
   • DDocument the shared responsibility model as part of the assessment scope and plan to verify the contractor's controls in the cloud environment.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A C3PAO is assessing a large organization with multiple business units. During the planning phase, the assessor discovers that the organization has not clearly defined which assets are in scope for CUI processing. The organization's management wants to include only the business unit that directly handles CUI, but the assessor suspects that other units may also process CUI. What is the most appropriate action?

   • AInsist that all business units be included in the scope to ensure compliance.
   • BWork with the organization to identify all assets that process CUI and document the scope accordingly.
   • CProceed with the assessment and include all business units to be safe.
   • DAccept the management's scope definition and assess only the identified business unit.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After completing a CMMC Level 2 assessment, the assessor must produce a report. Which element is most important to include in the report to ensure it is clear and accurate?

   • AThe overall compliance status and specific findings for each practice.
   • BThe names and contact information of all personnel interviewed.
   • CA detailed list of all evidence collected during the assessment.
   • DA comparison of the organization's practices to those of similar companies.
   Reveal Solution Discussion Select an answer first