Apply the Appropriate CMMC Source Documents to Evaluate CMMC Practice Implementation (minimum Coverage of Level 1 Practices) CCP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a CMMC Level 1 assessment, the assessor needs to evaluate the practice 'Limit information system access to authorized users, processes acting on behalf of authorized users, or devices.' The organization has a policy that only allows employees with a valid badge to access the facility where the system is located. Which evidence would best support the implementation of this practice?

   • AA written policy stating that only authorized users can access the system.
   • BA screenshot of the system's login screen requiring a username and password.
   • CA log of badge swipes at the facility entrance.
   • DA list of all employees who have a valid badge.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   CMMC Level 1 practice CA.L1-3.12.01 is derived from which source document and control requirement?

   • AFAR Clause 52.204-21
   • BNIST SP 800-171, control 3.12.1
   • CCMMC Model Overview, practice 3.12.1
   • DNIST SP 800-53, control AC-1
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A small defense contractor stores Controlled Unclassified Information (CUI) on a file server. During a CMMC Level 1 assessment, the assessor observes that the server requires a username and password for access. The assessor needs to verify that this practice is implemented as specified in the source documents. Which action best aligns with the assessor's evaluation?

   • AConfirm that the access control mechanism is documented in the organization's System Security Plan (SSP).
   • BEnsure that the file server is connected to the internet so that remote access can be tested.
   • CReview the CMMC Level 1 practice AC.L1-3.1.1 and verify that authorized users are granted access and unauthorized users are denied.
   • DCheck that the file server is configured with multi-factor authentication for all users.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An assessor is evaluating whether an organization has implemented CMMC Level 1 practice AC.L1-3.1.2, which requires limiting system access to the types of transactions and functions that authorized users are permitted to execute. Which evidence would best support that this practice is implemented?

   • AA documented access control policy and system configuration restricting user permissions to required functions
   • BA signed non-disclosure agreement from each employee
   • CA network diagram showing all connected devices
   • DA list of all employees and their job titles
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which document is the authoritative source for the specific practices an organization must implement to achieve CMMC Level 1 certification?

   • ACMMC Model Overview
   • BCMMC Scoping Guide
   • CCMMC Level 1 Practices
   • DCMMC Assessment Guide
   Reveal Solution Discussion Select an answer first