Apply Knowledge of the CMMC Assessment Criteria and Methodology to the Appropriate CMMC Practices CCP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   When an assessment finding indicates a practice is NOT MET, what is the assessor's primary responsibility?

   • ATo implement the corrective actions immediately
   • BTo ignore the finding if the organization is small
   • CTo automatically fail the organization's certification
   • DTo document the finding and recommend corrective actions
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An assessor is evaluating practice RA.L2-3.11.1 (periodically assess risk). The organization provides a risk assessment report that is two years old. The assessor also finds that the organization has not conducted any new risk assessments since then. What is the most appropriate evidence to evaluate the practice's implementation?

   • AThe assessor should mark the practice as 'Met' because the organization has a risk assessment process in place.
   • BThe lack of a recent risk assessment is evidence that the practice is not implemented.
   • CThe assessor should request additional evidence, such as a risk register or meeting minutes, to determine if the practice is being performed periodically.
   • DThe two-year-old report is sufficient evidence because it shows the organization has conducted a risk assessment.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an appropriate corrective action for a practice that is NOT MET due to missing documentation?

   • ACreate and implement the required policy or procedure
   • BRequest a waiver from the certification body
   • CDelete the practice from the assessment scope
   • DWait for the next assessment cycle to address it
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following best describes the role of the assessor when evaluating practice implementation?

   • ATo collect and examine evidence to determine if the practice is implemented
   • BTo provide consulting services to improve the practice
   • CTo implement the practice for the organization
   • DTo make the final decision on whether the organization is certified
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An assessor is evaluating practice PE.L2-3.10.3 (control physical access). The organization provides a visitor log, a policy on physical access, and a video of the entrance. The assessor notices that the visitor log is not consistently filled out and that the video footage is only kept for 30 days. Which of the following is the most appropriate evidence to evaluate the practice's implementation?

   • AThe policy document is the primary evidence because it defines the expected controls.
   • BThe video footage is the most reliable evidence because it is objective and cannot be falsified.
   • CAll three pieces of evidence should be evaluated together to determine if the practice is implemented.
   • DThe visitor log is the only valid evidence because it directly shows who enters the facility.
   Reveal Solution Discussion Select an answer first