CCP Requirements as Assessment Team Member During Phase 2 (Conduct Assessment) CCP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An assessment team is evaluating practice PE.L1-3.10.1 (physical access control). The organization has a badge system for entry to the facility. The CCP observes that the badge reader is not working and the door is propped open. The organization's representative states that the badge reader has been broken for two weeks and they are waiting for a replacement part. What should the CCP document?

   • AA nonconformity because the physical access control mechanism is not operational.
   • BThe practice is implemented because the badge system exists and is normally used.
   • CAn observation that the badge reader is broken, but no nonconformity because the organization is waiting for a part.
   • DA recommendation for improvement because the badge reader will be replaced soon.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A CCP is assigned to an assessment team for a CMMC Level 2 assessment. During the assessment, the CCP discovers that the organization being assessed is a subsidiary of the CCP's former employer, and the CCP previously worked on a project that implemented the very system now being assessed. What is the most appropriate action for the CCP to take?

   • ADisclose the potential conflict of interest to the lead assessor and recuse themselves from the assessment if required.
   • BComplete the assessment but note the prior relationship in the final report.
   • CContinue with the assessment but avoid discussing the prior project with the team.
   • DAsk the organization if they are comfortable with the CCP continuing the assessment.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a Phase 2 assessment, a CCP collects evidence for practice SC.L1-3.13.1 (system and communications protection). The CCP examines firewall configuration files and observes the network traffic monitoring dashboard. The CCP also interviews the network administrator. What is the most appropriate way for the CCP to document the evidence collected?

   • ADocument the evidence with specific references, including the firewall configuration file name, the date of the dashboard observation, and the interview notes.
   • BRecord a summary of the firewall configuration and the dashboard observation in the assessment notes.
   • CNote the evidence in the assessment report and include the firewall configuration file as an attachment.
   • DDescribe the evidence in general terms to avoid overwhelming the assessment report.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An assessment team is evaluating practice AC.L1-3.1.2 (account management). The organization provides a spreadsheet listing all user accounts and their access levels. The CCP wants to verify that the spreadsheet is accurate. What is the most appropriate method to verify this evidence?

   • AInterview the system administrator and ask if the spreadsheet is up to date.
   • BRequest a second spreadsheet from a different department to cross-check the first.
   • CCompare the spreadsheet against the actual user accounts in the system's user management interface.
   • DAccept the spreadsheet as accurate because it was provided by the organization's IT department.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a Phase 2 assessment, a CCP discovers a potential nonconformity in the organization's incident response practice. The CCP is unsure whether the evidence collected is sufficient to confirm the nonconformity. What is the most appropriate action for the CCP to take?

   • AMake a preliminary determination and document the nonconformity in the assessment report.
   • BConfront the organization's personnel with the potential nonconformity and ask for their explanation.
   • CDisregard the potential nonconformity because the CCP is not authorized to identify nonconformities.
   • DDiscuss the evidence with the lead assessor and request guidance on whether additional evidence is needed.
   Reveal Solution Discussion Select an answer first