Analyze the Adequacy/sufficiency Around the Location/collection/quality/usage of Evidence CCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When determining if evidence is sufficient to substantiate a CMMC practice, which factor is most important?

   • AThe evidence is approved by the organization's legal counsel
   • BThe evidence is collected in a single day
   • CThe evidence covers all relevant systems and timeframes
   • DThe evidence is stored in a cloud environment
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An assessor is evaluating the implementation of incident response practice IR.L2-3.6.1. The organization provides a single incident response plan document and a log of one tabletop exercise conducted six months ago. The assessor needs to determine if the practice is implemented. What should the assessor do?

   • ARely on the plan document as the primary evidence and note the exercise as supplementary.
   • BRequest additional evidence such as incident reports, communication logs, and records of plan updates or reviews.
   • CAccept the evidence as sufficient because the plan exists and an exercise was conducted.
   • DConclude the practice is not implemented because only one exercise was conducted.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An assessor is evaluating the implementation of access control practice AC.L2-3.1.3 (remote access). The organization provides a remote access policy and a screenshot of the VPN configuration. The screenshot shows that VPN is enabled, but there is no evidence of multi-factor authentication (MFA) being enforced. The policy requires MFA for remote access. What is the most appropriate action?

   • AUse the policy as evidence that MFA is implemented because it is a formal document.
   • BAccept the evidence because the policy requires MFA and the VPN is enabled.
   • CConclude that the practice is not implemented because MFA is not evident in the screenshot.
   • DRequest evidence that MFA is enforced, such as VPN logs showing MFA prompts or configuration settings.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An assessor is verifying the implementation of access control practice AC.L2-3.1.2 (account management). The organization provides user account lists from their HR system and their Active Directory. The lists show different sets of accounts. What is the most appropriate action?

   • AUse the HR system list as the authoritative source because it reflects official employment status.
   • BUse the Active Directory list as the authoritative source because it reflects actual system accounts.
   • CReconcile the two lists to identify discrepancies and investigate any accounts that do not match.
   • DAccept both lists as evidence and note that they are from different systems.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An assessor is reviewing evidence for system and communications protection practice SC.L2-3.13.1. The organization provides a network diagram that appears to be two years old, and a configuration file from a firewall that is currently in production. The diagram does not match the current network topology. What is the most appropriate assessment of this evidence?

   • AThe diagram is sufficient because it shows the intended network architecture.
   • BBoth pieces of evidence are equally reliable and can be used together.
   • CThe diagram is relevant but not timely, so it should be supplemented with current documentation or interviews.
   • DThe configuration file is sufficient because it is from the production firewall.
   Reveal Solution Discussion Select an answer first