CCP Role Selection During Phase 1 (Plan and Prepare) CCP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A CCP is preparing for a CMMC assessment and is reviewing the organization's access control policies. The CCP notices that the policies do not mention multi-factor authentication (MFA) for remote access. What should the CCP do with this observation?

   • AIgnore the observation because it is not part of the assessment scope.
   • BNote the observation and include it in the assessment plan as a potential area to examine.
   • CImmediately report the organization to the CMMC Accreditation Body (CMMC-AB).
   • DAssume the organization is non-compliant and record it as a finding.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A CCP is part of a team preparing for a CMMC Level 1 assessment. The Lead Assessor is developing the assessment plan and asks the CCP to identify potential risks to the assessment schedule. Which action best demonstrates proper coordination with the Lead Assessor?

   • AThe CCP independently adjusts the schedule to mitigate risks and informs the Lead Assessor afterward.
   • BThe CCP ignores the risks because they are not part of the CCP's responsibilities.
   • CThe CCP documents the risks and discusses them with the Lead Assessor to determine mitigation strategies.
   • DThe CCP reports the risks directly to the organization's management without consulting the Lead Assessor.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why does a CCP need to understand the organization's environment during Phase 1?

   • ATo determine the organization's CMMC level without consulting the contract
   • BTo prepare the final certification report for the Lead Assessor
   • CTo implement security controls on behalf of the organization
   • DTo identify the systems and assets that are in scope for the assessment
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does the CCP's role differ from the Lead Assessor's role during Phase 1?

   • AThe CCP conducts the assessment, while the Lead Assessor only reviews the final report
   • BThe CCP makes the certification decision, while the Lead Assessor prepares the plan
   • CThe CCP implements security controls, while the Lead Assessor reviews documentation
   • DThe CCP supports planning and preparation, while the Lead Assessor leads and oversees the assessment
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A CCP is contributing to the assessment plan during Phase 1. The Lead Assessor asks the CCP to include a list of evidence to be collected for each CMMC practice. The CCP notices that the list includes evidence that would require the organization to provide sensitive data that is not typically part of the assessment. What should the CCP do?

   • AInclude the evidence list as requested to avoid conflict with the Lead Assessor.
   • BAsk the organization to provide the sensitive data to test the assessment process.
   • CRemove the sensitive evidence items from the list without telling the Lead Assessor.
   • DDiscuss the concern with the Lead Assessor and suggest adjusting the evidence list.
   Reveal Solution Discussion Select an answer first