Which action is part of proper evidence handling to maintain integrity?

Storing evidence in a secure location with restricted access

Allowing all assessment team members to modify evidence

Deleting evidence after the assessment

Keeping evidence in an unlocked shared folder

An assessor is evaluating the audit logging practice. Which of the following is the most appropriate evidence object to verify that audit logs are being generated and retained?

A screenshot of the logging software installation wizard

An interview with the system administrator about logging practices

A sample of audit log records with timestamps and the log retention policy

A network diagram showing the logging server's location

An assessor collects a configuration file from a server as evidence. To maintain chain of custody, what is the most appropriate action?

Record the collection date, time, source system, and the assessor's identity, then store the file in a controlled location

Ask the system administrator to keep the file until the assessment is complete

Save the file to a shared drive without additional documentation

Email the file to the assessment team for immediate review

CMMC Certified Assessor

Domain 4Objective 1

Identify Evidence Verification/validation Methods and Objects for Practices Based on the CMMC Level 2 Assessment Guide and CMMC Assessment Process (CAP) Documentation CCA Practice Questions (Page 3)

Part of the Domain 4: Assessing CMMC Level 2 Practices (40%) domain, which accounts for 40% of the CCA exam.

28questions here

6free pages

7concepts

40%of the exam

Questions 11–15

11foundation · easy
An assessor reviews a written security policy document to determine if it includes required access control provisions. Which evidence verification method is being applied?
Select an answer first
12foundation · easy
Which action is part of proper evidence handling to maintain integrity?
Select an answer first
13application · medium
An assessor is evaluating the audit logging practice. Which of the following is the most appropriate evidence object to verify that audit logs are being generated and retained?
Select an answer first
14application · medium
An assessor collects a configuration file from a server as evidence. To maintain chain of custody, what is the most appropriate action?
Select an answer first
15foundation · easy
An assessor validates that a firewall configuration file is directly related to the access control practice being assessed. Which validation characteristic is being evaluated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCA” is a trademark of its owner, used for identification only.

Identify Evidence Verification/validation Methods and Objects for Practices Based on the CMMC Level 2 Assessment Guide and CMMC Assessment Process (CAP) Documentation CCA Practice Questions (Page 3)

Questions 11–15

An assessor reviews a written security policy document to determine if it includes required access control provisions. Which evidence verification method is being applied?

Which action is part of proper evidence handling to maintain integrity?

An assessor is evaluating the audit logging practice. Which of the following is the most appropriate evidence object to verify that audit logs are being generated and retained?

An assessor collects a configuration file from a server as evidence. To maintain chain of custody, what is the most appropriate action?

An assessor validates that a firewall configuration file is directly related to the access control practice being assessed. Which validation characteristic is being evaluated?

Keep studying — Domain 4: Assessing CMMC Level 2 Practices (40%)