Apply Knowledge of the CMMC Assessment Criteria and Methodology to the Appropriate CMMC Practices CCP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a Level 2 assessment, the assessor finds that practice AU.L2-3.3.1 (create and retain system audit logs) is not implemented because the organization does not have a centralized logging solution. The organization argues that they have a policy requiring logs to be kept on individual workstations. What is the most appropriate corrective action to recommend?

   • ARecommend the organization demonstrate that logs are being created and retained on individual workstations, and that they can be accessed for review.
   • BRecommend the organization implement a centralized logging solution immediately.
   • CAccept the organization's argument and mark the practice as 'Met' because a policy exists.
   • DMark the practice as 'Not Met' and do not offer any corrective action because the organization is not compliant.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a Level 2 assessment, the assessor finds that practice CM.L2-3.4.1 (establish and maintain baseline configurations) is not implemented. The organization has no configuration baseline for their systems. What is the most appropriate corrective action to recommend?

   • ARecommend the organization develop and document a baseline configuration for their systems.
   • BRecommend the organization implement a change management process.
   • CRecommend the organization hire a consultant to create the baseline.
   • DRecommend the organization purchase a commercial configuration management tool.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of the reporting phase in a CMMC assessment?

   • ATo collect evidence and test controls
   • BTo determine the scope of the assessment
   • CTo document findings and provide the official assessment results
   • DTo develop a corrective action plan for the organization
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of evaluating evidence against CMMC assessment criteria?

   • ATo determine if the practice is implemented as required
   • BTo create a list of all security controls in the organization
   • CTo assign a risk score to the organization
   • DTo compare the organization to industry benchmarks
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement accurately describes the structure of CMMC practices?

   • APractices are optional recommendations that organizations can choose to implement.
   • BEach practice is a single, atomic requirement that cannot be broken down further.
   • CPractices are only technical controls and do not include administrative or physical measures.
   • DPractices are grouped into domains and may have multiple parts that must all be implemented.
   Reveal Solution Discussion Select an answer first