CCA CCA Evidence Collection & Documentation 2

Question 1

What does the CMMC Assessment Guide specify regarding the 'test' assessment method?

Accepted Answer

Tests involve exercising or operating controls to observe how they function and verify their effectiveness

Answer

Testing involves exercising controls — such as simulating events or performing functional checks — to observe whether they operate as intended and produce expected results.

Question 2

How should a CCA assessor document a practice determination of 'Not Met'?

Accepted Answer

With specific evidence, the gap identified, and the practice objective that was not satisfied

Answer

'Not Met' findings must be documented with the specific evidence reviewed, the identified gap, and which practice objective was not satisfied to ensure transparency and defensibility.

Question 3

What is the purpose of interviewing personnel during a CMMC assessment?

Accepted Answer

To gather information about security practice implementation that may not be fully captured in documentation

Answer

Interviews with knowledgeable personnel provide context, clarify how practices are actually implemented day-to-day, and can surface discrepancies between documented procedures and actual practice.

Question 4

Which of the following is an example of objective evidence for assessing the practice of enforcing password complexity requirements?

Accepted Answer

A screenshot of Active Directory Group Policy settings showing complexity requirements enabled

Answer

A screenshot of Group Policy settings directly shows the technical enforcement of password complexity, providing objective evidence that the requirement is implemented at the system level.

Question 5

How should assessors handle conflicting evidence during a CMMC assessment?

Accepted Answer

Document all conflicting evidence, gather additional evidence to resolve the conflict, and make a determination based on the weight of evidence

Answer

When evidence conflicts, assessors must document the conflict, seek additional evidence to clarify, and make a reasonable determination based on the totality of available evidence.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA CCA Evidence Collection & Documentation 2