Identify Evidence Verification/validation Methods and Objects for Practices Based on the CMMC Level 2 Assessment Guide and CMMC Assessment Process (CAP) Documentation CCA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An assessor collects a database export as evidence for the system and information integrity practice. The export is large and must be transferred to the assessment team's secure storage. What is the most appropriate handling procedure?

   • AStore the export on a shared drive without encryption to simplify access
   • BAsk the organization to keep the export until the assessment is complete
   • CTransfer the export over email because it is the fastest method
   • DEncrypt the export, transfer it over a secure channel, and document the transfer in the chain of custody log
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During an assessment, an organization provides a network diagram to support the boundary protection practice. The assessor notices the diagram is dated three years ago and does not reflect the current subnet structure shown in the live router configuration. What is the most appropriate validation action for this evidence?

   • AAccept the diagram because it is an official organizational document
   • BReject the diagram as insufficiently current and request the current network diagram or a configuration export
   • CRequest a signed attestation from the network administrator confirming the diagram is still accurate
   • DAccept the diagram and note it as a minor discrepancy in the assessment report
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   During evidence validation, an assessor checks that a system-generated log file has not been modified since it was collected. Which aspect of validation is being confirmed?

   • AAccuracy
   • BRelevance
   • CAuthenticity
   • DSufficiency
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When mapping evidence to a CMMC Level 2 practice, what is the assessor's primary goal?

   • ATo assign a score to each piece of evidence
   • BTo ensure that each practice has sufficient evidence to support the assessment conclusion
   • CTo collect as much evidence as possible for each practice
   • DTo create a list of all evidence collected
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization provides a screenshot of a security policy as evidence for the awareness and training practice. The screenshot appears to be from a document that was last modified two years ago. What is the most appropriate validation action?

   • AAccept the screenshot and note the modification date in the report
   • BAccept the screenshot because it shows the policy exists
   • CReject the screenshot because it is not a valid evidence object
   • DRequest the original policy document and verify its current version and approval date
   Reveal Solution Discussion Select an answer first