Demonstrate Understanding of the CMMC Source and Supplementary Documents CCP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What should an organization do when a supplementary document like NIST SP 800-171 is revised?

   • AImmediately re-certify their CMMC level
   • BDelete any references to the old version from their documentation
   • CReview the revision to determine if it affects their CMMC implementation
   • DIgnore the revision because CMMC is based on the original version
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which supplementary document provides enhanced security requirements for protecting CUI against advanced persistent threats (APTs)?

   • ACMMC Model Overview
   • BCMMC Assessment Guide
   • CNIST SP 800-172
   • DNIST SP 800-171
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is implementing CMMC Level 2 and is mapping its controls to the practices. The team finds that a specific practice in the CMMC Model Overview is not directly aligned with any single requirement in NIST SP 800-171. The practice appears to be a combination of multiple requirements. What is the most accurate interpretation of this situation?

   • AThe practice is invalid because it does not map to a single NIST SP 800-171 requirement.
   • BThe team should ignore the practice because it is not in NIST SP 800-171.
   • CThe team should implement the practice based on the CMMC Assessment Guide, not the Model Overview.
   • DThe practice is likely derived from a combination of NIST SP 800-171 requirements and possibly other sources, and the team should implement it as defined in the CMMC Model Overview.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is a primary source document for CMMC assessments, providing guidance on how to conduct assessments?

   • ANIST SP 800-172
   • BFederal Register Notice
   • CCMMC Assessment Guide
   • DCMMC Model Overview
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is implementing CMMC Level 2 and wants to understand the intent behind a specific practice related to incident response. The team finds the practice in the Model Overview but needs more context on the expected evidence and assessment methods. Which supplementary document should they consult?

   • AThe CMMC Model Overview
   • BThe CMMC Assessment Guide (Level 2)
   • CThe Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012
   • DNIST SP 800-172
   Reveal Solution Discussion Select an answer first