Identify Evidence Verification/validation Methods and Objects for Practices Based on the CMMC Level 2 Assessment Guide and CMMC Assessment Process (CAP) Documentation CCA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An assessor has collected a system security plan (SSP), a risk assessment report, and a plan of action and milestones (POA&M). Which CMMC Level 2 practice is this evidence most directly mapped to?

   • AImplement an incident response plan
   • BDevelop and maintain a system security plan
   • CMaintain a baseline configuration of systems
   • DLimit system access to authorized users
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An assessor is collecting evidence for the incident response practice. The organization has a centralized SIEM with 10,000 incident alerts from the past year. The assessor has limited time and must also verify the incident response plan is current. What is the most appropriate collection procedure?

   • ACollect a convenience sample of alerts from the last month and the incident response plan
   • BCollect only the incident response plan and skip the alerts due to time constraints
   • CCollect all 10,000 alerts and the incident response plan
   • DCollect the incident response plan and a statistically valid random sample of alerts from the SIEM
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   During a CMMC Level 2 assessment, the assessor observes the system administrator entering commands to change a user's access permissions. Which evidence verification method is being used?

   • ATesting
   • BInterview
   • CValidation
   • DExamination
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When applying sampling methods for evidence, what is the primary purpose of sampling?

   • ATo ensure that all evidence is collected
   • BTo make the assessment faster without any regard for accuracy
   • CTo eliminate the need for evidence validation
   • DTo reduce the amount of evidence needed to a manageable level while maintaining confidence
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An assessor is verifying the configuration management practice. The organization has 50 servers, each with a configuration baseline. The assessor has limited time and must determine whether the practice is implemented. What is the most appropriate sampling approach?

   • ASelect the first 10 servers in the asset inventory list
   • BExamine the configuration baselines of all 50 servers to ensure complete coverage
   • CExamine the configuration baseline of the server that manages the most critical data
   • DSelect a random sample of servers and examine their configuration baselines against the approved standard
   Reveal Solution Discussion Select an answer first