CCP Role in Phase 4 (Evaluation of Outstanding Assessment POA&M Items) CCP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A CCP is documenting the results of a POA&M item evaluation. The evidence shows that the OSC has implemented a control, but there are minor gaps in the implementation. How should the CCP document this item?

   • AOpen, because no evidence was provided.
   • BClosed, because the control is implemented.
   • CPartially addressed, because there are gaps in the implementation.
   • DClosed, with a note to address the gaps later.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A CCP is reviewing evidence for a POA&M item about access control. The OSC provided a policy document and a screenshot of a user access review. The CCP notices that the screenshot is from a different system than the one being assessed. What should the CCP do?

   • ADocument the item as open because the evidence is not from the correct system.
   • BAccept the evidence because the policy is relevant.
   • CMark the item as closed because the policy is in place.
   • DRequest evidence from the correct system to verify the control.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is an effective way for a CCP to communicate POA&M evaluation results?

   • ADiscussing findings only with the organization's staff
   • BPosting findings on social media
   • CWithholding information until the final report
   • DProviding clear and concise summaries to the lead assessor
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which technique is used to verify evidence for a POA&M item?

   • AAccepting all evidence without question
   • BRelying solely on the organization's self-assessment
   • CIgnoring evidence that contradicts the remediation claim
   • DInterviewing personnel responsible for the remediation
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which status can be assigned to a POA&M item after evaluation?

   • ARejected without review
   • BDeferred indefinitely
   • CApproved for certification
   • DPartially addressed
   Reveal Solution Discussion Select an answer first