Identify Evidence Verification/validation Methods and Objects for Practices Based on the CMMC Level 2 Assessment Guide and CMMC Assessment Process (CAP) Documentation CCA Practice Questions (Page 6)

Questions 26–28

1. 26foundation · easy

   Which of the following is an example of an evidence object that could be used to verify a configuration management practice?

   • AA system configuration baseline document
   • BA test of a security control
   • CAn interview with the IT manager
   • DA verbal description of the configuration process
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An assessor is collecting evidence for the incident response practice. The organization has a ticketing system with 500 incident records from the past year. According to the CMMC Assessment Process (CAP), what is the most appropriate collection procedure for this evidence?

   • ARequest a summary report of incident trends instead of individual tickets
   • BCollect a representative sample of incident tickets across the assessment period and document the sampling rationale
   • CCollect all 500 incident tickets to ensure complete coverage
   • DCollect only the most recent 10 incident tickets as a convenience sample
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   An assessor is verifying the maintenance practice. The organization has 100 pieces of equipment with maintenance records. The assessor selects a random sample of 20 records and finds no discrepancies. What is the most appropriate conclusion?

   • AThe practice is fully compliant because no discrepancies were found
   • BThe sample is insufficient because 20 is too small a sample size
   • CThe assessor must review all 100 records to confirm compliance
   • DThe sample supports a conclusion that the practice is implemented, subject to the sampling rationale
   Reveal Solution Discussion Select an answer first