Identify Evidence Verification/validation Methods and Objects for Practices Based on the CMMC Level 2 Assessment Guide and CMMC Assessment Process (CAP) Documentation CCA Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of an evidence object that could be used to verify a CMMC Level 2 practice?

   • AA system-generated audit log
   • BA verbal confirmation from the system administrator
   • CThe assessor's personal opinion
   • DA verbal agreement to implement a control
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An assessor is collecting evidence for the risk assessment practice. The organization has a risk register with 500 risks and a risk assessment report. The assessor must collect evidence efficiently while maintaining chain of custody. What is the most appropriate procedure?

   • ACollect only the risk assessment report and skip the risk register
   • BCollect the entire risk register and the risk assessment report without sampling
   • CCollect a convenience sample of risks and the risk assessment report without documenting the rationale
   • DCollect the risk assessment report and a representative sample of risks from the register, documenting the sampling rationale and securing the evidence
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An assessor is verifying the access control practice. The organization has 500 user accounts, and the assessor selects a random sample of 50. In the sample, 5 accounts are found to be inactive but still enabled. What is the most appropriate conclusion?

   • AThe practice is non-compliant, and the assessment should be concluded immediately
   • BThe assessor should ignore the finding because it is within the margin of error
   • CThe practice is not fully implemented, and the assessor should consider the finding's impact on the overall assessment
   • DThe practice is compliant because the sample size was small
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An assessor has collected the following evidence: a network diagram, a firewall configuration export, and a vulnerability scan report. Which CMMC Level 2 practice is this evidence most directly mapped to?

   • AImplement an incident response plan
   • BImplement a risk management plan for supply chain
   • CMaintain a baseline configuration of systems
   • DImplement boundary protection
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of maintaining a chain of custody for evidence during a CMMC assessment?

   • ATo speed up the assessment process
   • BTo allow the organization to review the evidence
   • CTo document the evidence's authenticity and integrity from collection to presentation
   • DTo ensure the evidence is not lost or misplaced
   Reveal Solution Discussion Select an answer first