Analyze the Adequacy/sufficiency Around the Location/collection/quality/usage of Evidence CCP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An assessor is evaluating the implementation of system and information integrity practice SI.L2-3.14.1 (flaw remediation). The organization provides a vulnerability scan report from an external scanning service and a remediation ticket log from their internal IT system. The scan report shows critical vulnerabilities that are not listed in the remediation log. How should the assessor use this evidence?

   • AUse the remediation log as the primary evidence and disregard the scan report because it is from an external source.
   • BConclude that the practice is not implemented because the remediation log does not match the scan report.
   • CUse the scan report as the primary evidence and disregard the remediation log because it is incomplete.
   • DInvestigate the discrepancy to determine if the vulnerabilities were remediated but not logged, or if the scan report is inaccurate.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During an assessment, the assessor is evaluating the implementation of awareness and training practice AT.L2-3.2.1. The organization provides a training completion report showing that 95% of employees completed the annual security awareness training. The assessor also interviews a few employees who confirm they received the training. How should the assessor use this evidence?

   • ADisregard the report because it is generated by the organization and may be biased.
   • BRely solely on the interviews because they are firsthand accounts.
   • CUse the training completion report as the primary evidence and the interviews as supplementary confirmation.
   • DConsider the practice implemented only if 100% of employees completed the training.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An assessor is evaluating the implementation of system and communications protection practice SC.L2-3.13.5 (network segmentation). The organization provides a network diagram and a configuration file from a router. The diagram shows a flat network, but the configuration file shows VLAN segmentation. The assessor interviews the network administrator who confirms that VLANs are implemented. How should the assessor weigh this evidence?

   • ARely on the configuration file and interview because they are more current and accurate.
   • BDisregard the interview because it is subjective.
   • CRely on the network diagram because it is the official documentation.
   • DConclude that the practice is not implemented because the diagram shows a flat network.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a CMMC Level 2 assessment, the assessor is verifying access control practice AC.L2-3.1.1. The organization provides a screenshot of a user access review report generated from their identity management system. The assessor notes the report shows only the last 30 days of activity. The assessment period covers the previous 12 months. What is the most appropriate action for the assessor?

   • ARequest additional evidence, such as historical access review reports or audit logs, to cover the full assessment period.
   • BUse the 30-day report as a representative sample and extrapolate the findings to the full year.
   • CAccept the evidence as sufficient because the report is from the authoritative system and demonstrates current access controls.
   • DMark the practice as 'Not Implemented' because the evidence does not cover the full assessment period.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An assessor is verifying the implementation of physical protection practice PE.L2-3.10.1 (physical access control). The organization provides a visitor log from the front desk and a key issuance log from the facilities department. The visitor log shows entries for the assessment period, but the key issuance log is missing entries for the last three months. What is the most appropriate action?

   • ARequest the missing key issuance records or an explanation for the gap.
   • BUse the visitor log as the only evidence because it is from the authoritative system.
   • CAccept the evidence because the visitor log covers the assessment period.
   • DConclude that the practice is not implemented because the key issuance log is incomplete.
   Reveal Solution Discussion Select an answer first