CCA CCA Evidence Collection & Documentation 3

Question 1

What must a CCA assessor do if an OSC provides documentation that appears to have been created specifically for the assessment rather than representing actual operations?

Accepted Answer

Flag the concern, seek corroborating evidence through interviews and system observations, and document the discrepancy

Answer

Accept the documentation without question

Answer

Immediately terminate the assessment and report fraud to DoD IG

Answer

Request the OSC to backdate the documentation

Question 2

In CMMC assessment documentation, what is a 'corrective action plan'?

Accepted Answer

A documented plan for addressing 'Not Met' findings that may allow conditional progress toward certification

Answer

A legal document filed against the OSC for non-compliance

Answer

A quality improvement plan for the C3PAO's assessment process

Answer

A military action plan for responding to cyber incidents

Question 3

How long must C3PAOs retain CMMC assessment records?

Accepted Answer

6 years from the date of assessment completion

Answer

1 year from the date of assessment completion

Answer

The duration of the DoD contract only

Answer

Indefinitely with no retention limit

Question 4

What does it mean when a CMMC assessor assigns a practice determination of 'Not Applicable' (NA)?

Accepted Answer

The practice is not relevant to the OSC's assessed environment based on the scoped system boundary

Answer

The assessor could not find evidence either way

Answer

The OSC has requested a waiver for the practice

Answer

The practice only applies to CMMC Level 3

Question 5

Which of the following best describes the Final Assessment Report in the CMMC assessment lifecycle?

Accepted Answer

The authoritative record of all findings, determinations, and the overall CMMC Level achievement submitted to the CMMC-AB

Answer

A preliminary document shared only with the OSC

Answer

An internal C3PAO quality assurance document

Answer

A marketing document describing the C3PAO's assessment methodology

Question 6

What is the assessor's responsibility when reviewing an OSC's incident response documentation during a CMMC assessment?

Accepted Answer

To assess whether the documentation addresses CMMC incident response practice requirements and that personnel know how to execute the plan

Answer

To verify the plan was created by a qualified cybersecurity professional

Answer

To test whether the plan can withstand a DoD red team exercise

Answer

To confirm the plan was approved by the contracting officer