Apply Knowledge of the CMMC Assessment Criteria and Methodology to the Appropriate CMMC Practices CCP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   During a Level 2 assessment, the assessor finds that practice SI.L2-3.14.2 (detect and report events) is not implemented. The organization has a SIEM tool but has not configured any alerts or reports. The organization argues that the SIEM is collecting logs, which is sufficient. What is the most appropriate corrective action to recommend?

   • ARecommend the organization purchase a new SIEM tool that is easier to configure.
   • BRecommend the organization rely on manual log reviews instead of the SIEM.
   • CRecommend the organization document that the SIEM is collecting logs and mark the practice as 'Met'.
   • DRecommend the organization configure the SIEM to generate alerts and reports for security events.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is an example of evidence that could be used to evaluate a CMMC practice?

   • AThe assessor's personal opinion about the practice
   • BThe organization's marketing materials
   • CThe organization's financial statements
   • DA policy document that describes the required controls
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which phase of the CMMC assessment methodology involves defining the scope and objectives of the assessment?

   • ACorrective Action
   • BReporting
   • CConducting
   • DPlanning
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An assessor is planning a Level 2 assessment for a defense contractor. The contractor has a large environment with multiple facilities. The assessor is determining the scope of the assessment. Which of the following is the most important factor to consider when defining the assessment scope?

   • AThe systems and assets that process, store, or transmit CUI.
   • BThe physical locations of all facilities.
   • CThe number of employees in the organization.
   • DThe organizational structure and reporting lines.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of a gap analysis in a CMMC assessment?

   • ATo identify which practices are not fully implemented
   • BTo select the best security software for the organization
   • CTo compare the organization to its competitors
   • DTo determine the organization's budget for cybersecurity
   Reveal Solution Discussion Select an answer first