Apply Knowledge of the CMMC Assessment Criteria and Methodology to the Appropriate CMMC Practices CCP Practice Questions (Page 4)

Questions 16–17

1. 16foundation · easy

   When mapping a CMMC practice to assessment criteria, what is the primary purpose of identifying the 'assessment objectives'?

   • ATo determine the specific evidence and evaluation methods needed to verify the practice
   • BTo assign a score to the practice based on its importance
   • CTo create a corrective action plan for the organization
   • DTo list all possible security controls that could be implemented
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   During a Level 2 assessment, the assessor finds that practice IA.L2-3.5.1 (identify information system users and processes acting on behalf of users) is not implemented. The organization has a policy that requires unique user IDs, but the assessor finds that several users share a common account for a legacy system. What is the most appropriate corrective action to recommend?

   • ARecommend the organization disable the legacy system immediately.
   • BRecommend the organization implement a new system that supports unique user IDs.
   • CRecommend the organization create unique user IDs for all users on the legacy system.
   • DRecommend the organization document that the legacy system is an exception.
   Reveal Solution Discussion Select an answer first