CCP Role Selection During Phase 1 (Plan and Prepare) CCP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization is preparing for its first CMMC Level 2 assessment. During Phase 1, the CCP is asked to help the organization understand what will happen during the assessment. Which activity best aligns with the Phase 1 goal of planning and preparation?

   • AConducting a walkthrough of the organization's facilities to observe security controls in operation.
   • BIssuing a formal certificate of compliance to the organization.
   • CReviewing the organization's CMMC scope and identifying the assets and practices that will be assessed.
   • DTesting the organization's network vulnerability scanning tools.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a key pre-assessment task a CCP performs during Phase 1?

   • AImplementing security controls to remediate identified gaps
   • BInterviewing all employees about their security awareness
   • CReviewing the organization's System Security Plan (SSP) and related policies
   • DConducting penetration testing on the organization's network
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During Phase 1, a CCP is asked to review the organization's training records to verify that employees have completed CMMC awareness training. The CCP finds that the records are incomplete. The Lead Assessor is busy and asks the CCP to decide whether this is a finding. What should the CCP do?

   • AIgnore the incomplete records because training is not part of the assessment.
   • BDocument the observation and defer the finding determination to the Lead Assessor.
   • CDecide that it is a finding and include it in the assessment report.
   • DAsk the organization to provide new training records immediately.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following best describes the scope of Phase 1 in the CMMC assessment lifecycle?

   • AThe scope is limited to the post-assessment reporting and corrective action
   • BThe scope covers planning, preparation, and initial documentation review
   • CThe scope is limited to the on-site assessment activities only
   • DThe scope includes all activities from initial planning through the final report submission
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A CCP is part of a team preparing for a CMMC assessment. The Lead Assessor has developed a draft assessment plan, but the CCP identifies a conflict: the plan schedules interviews with the organization's IT staff on the same day as a major system maintenance window. What should the CCP do?

   • AConduct the interviews without the IT staff and rely on documentation.
   • BProceed with the plan as written because the Lead Assessor approved it.
   • CReschedule the maintenance window with the organization's IT staff.
   • DInform the Lead Assessor of the conflict and suggest alternative interview times.
   Reveal Solution Discussion Select an answer first