CCP Requirements as Assessment Team Member During Phase 2 (Conduct Assessment) CCP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When applying assessment procedures from the CMMC Assessment Guide, what should an assessor use to evaluate whether a practice is implemented?

   • AThe organization's cybersecurity budget
   • BThe organization's self-assessment results
   • CThe lead assessor's personal judgment
   • DThe defined assessment objectives and methods for each practice
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During Phase 2 of a CMMC assessment, a CCP is assigned to verify the organization's implementation of access control practice AC.L1-3.1.1. The organization's IT administrator provides a written policy document and a screenshot of the access control list from the server. The CCP notices that the screenshot shows a date that is six months old. What is the most appropriate action for the CCP to take?

   • ARequest a current, live demonstration or a newly captured screenshot to verify the practice is actively implemented.
   • BRecord the screenshot in the assessment report and note that it was provided by the administrator.
   • CAccept the screenshot as valid evidence because the policy document confirms the practice is implemented.
   • DDocument the screenshot as a nonconformity because it is not dated within the assessment period.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What should an assessor include when documenting an assessment finding?

   • ARecommendations for improving the organization's security
   • BThe assessor's personal opinion about the organization's cybersecurity posture
   • CA reference to the evidence that supports the finding
   • DThe organization's self-reported compliance status
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A CCP is conducting interviews with system administrators during Phase 2. One administrator states that they do not have a formal process for reviewing audit logs, but they 'just check them when something seems wrong.' The CCP observes that the organization's written procedure requires weekly log reviews, but no log review records exist for the past three months. What should the CCP do?

   • AImmediately inform the organization's management that the practice is nonconformant and the assessment is at risk.
   • BAsk the administrator to create a log review record for the past three months to demonstrate compliance.
   • CAccept the administrator's verbal assurance that logs are reviewed informally, since the intent of the practice is met.
   • DDocument the interview statement and the absence of log review records as evidence of a nonconformity, and report it to the lead assessor.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What must a CCP do to maintain confidentiality during an assessment?

   • AProtect all assessment data and only share it with authorized individuals
   • BShare findings with the organization's competitors to ensure transparency
   • CPublish a summary of the assessment results on social media
   • DDiscuss assessment findings with other CCPs to get their opinion
   Reveal Solution Discussion Select an answer first