CCP Role Selection During Phase 1 (Plan and Prepare) CCP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A CCP is preparing for a CMMC assessment and is reviewing the organization's system security plan (SSP). The SSP describes the system architecture but does not include a data flow diagram. The CCP needs to understand how CMMC data flows through the environment. What should the CCP do?

   • AAsk the Lead Assessor to skip the data flow review.
   • BCreate a data flow diagram based on the SSP and include it in the assessment plan.
   • CProceed without the data flow diagram because it is not required for the assessment.
   • DRequest a data flow diagram from the organization and review it for accuracy.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is a key aspect of the CCP's coordination with the assessment team during Phase 1?

   • AApproving the organization's corrective action plan
   • BSharing relevant documentation and observations with the Lead Assessor
   • CCommunicating findings to the organization's management
   • DConducting the final evidence review
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A CCP is part of a CMMC assessment team preparing for a Level 2 assessment. The Lead Assessor has assigned the CCP to review the organization's incident response plan and identify potential evidence gaps. The CCP finds that the plan lacks a defined escalation path. What should the CCP do with this finding?

   • ADirect the organization to revise the incident response plan immediately.
   • BIgnore the gap because it is not related to the assessment scope.
   • CReport the finding to the Lead Assessor and suggest it be noted as a potential gap for the assessment plan.
   • DRecord the finding as a confirmed non-compliance in the assessment report.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A CCP is reviewing the organization's configuration management plan during Phase 1. The plan references a set of baseline configurations, but the CCP cannot find the actual baseline documents. The organization says the baselines are 'in development' and will be ready before the assessment. What should the CCP do?

   • ACreate the baseline documents for the organization.
   • BMark the organization as non-compliant for missing baselines.
   • CDocument the missing baselines as a potential risk and discuss it with the Lead Assessor.
   • DAccept the organization's assurance and proceed with the assessment plan.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During Phase 1 of a CMMC assessment, the CCP is tasked with producing a document that outlines the assessment schedule, team assignments, and key activities. Which deliverable is the CCP most likely contributing to?

   • AThe organization's System Security Plan (SSP).
   • BThe assessment plan.
   • CThe final CMMC certification report.
   • DThe corrective action plan (CAP).
   Reveal Solution Discussion Select an answer first